Well, I\'ve been working on an User-Agent based shared-session protection between subdomains.
I was extremely surprised that it\'s been working well until IE 11 prev
Microsoft has the site in question configured to use UA-spoofing (via the Compatibility View list) and that causes IE to send a custom UA string.
CompatView-based UA spoofing was enabled in IE8 in 2008: http://blogs.msdn.com/b/ie/archive/2008/08/27/introducing-compatibility-view.aspx
And in IE10+, it's gotten richer, with per-site spoofing to enable the best experience. See http://blogs.msdn.com/b/ieinternals/archive/2013/09/21/internet-explorer-11-user-agent-string-ua-string-sniffing-compatibility-with-gecko-webkit.aspx for an exploration of this topic.