From the Apple developer faq
Safari ships with a conservative cookie policy which limits cookie writes to only the pages chosen (\"navigated to\
This is a common issue with facebook apps displayed in Safari. The way many (including myself) have dealt with this is to have the iframed page POST to itself. When a page has posted form data, it is then allowed to set cookies. In the end, it works with a 1 page refresh, which could even be your user login POST.