I have an app using PHP and the PayPal API. The basic way it works to get a payment is that you do a web service call to PayPal to get a token and then do a browser redirect to
Just an idea ...
Do you have session.referer_check
set to your host perhaps?
The default is the empty string, but it might have been changed ... and when the page 'comes back' from PayPal, php will trash the session info.
You can check the session.referer_check
with phpinfo().
Can you do a phpinfo() and tell if session.auto_start is true?