I had the same problem and it seemed to be caused for me by having the excel importer module added to my project. I removed the excel importer and its java which solved the problem. Mine seemed to occur when I had microflow buttons on the mobile homepage. It also occurred if I used a mobile device. If I used navigation buttons it worked fine. I tried to create a test project but couldn't replicate it, so at least I am not the only one with this issue.
Do you happen to see HTTP status code 460 being returned? If so then this is a known bug, we fixed this but this fix is not released yet. The cause has to do with too much data being sent during mobile login and cookies consequently not being set. This is probably also why removing the excel importer module fixed things for Simon, as it reduces the amount of data (in terms of entity data, etc.) being sent.
I recommend filing a bug report and asking for a 4.0.2 release if you can't wait for 4.1