I have an iframe that:
I dunno if you ever figured this out, but make sure you're instructing your application to not set client cookies. In CF, there's an application parameter 'setClientCookies', when setting it to false makes sure what you're describing doesn't happen. (Coincidentally, setting it to 'false' or 'no' does not work where as CF normally recognizes this as false as well.)