Well, just in case it’s useful to anybody I’ll let you know how I fixed it in the end:
The whole problem was down to the canonical domain set in the wordpress settings. I set a canonical domain via .htaccess and set the same canonical domain in wordpress et voila!
Now I can happily use sessions just by starting the session in the normal way at the top of my theme template pages.
This was also causing a ‘same-domain policy’ issue when trying to use ajax, but the canonical domain fixed this too.
Can’t believe it’s taken me this long to work this out! I’m officially retarded.