sub go {
  my $self=shift;
  my $sid=$self->query->cookie('CGISESSID');
  $self->session(new CGI::Session("driver:MySQL", $sid, {Handle=>$self->db->dbh}));
  my $cookie = $self->query->cookie(CGISESSID=>$self->session->id);
  if (!$sid) {
    print (STDERR "No cookie, setting cookie and forwarding to cookiechecker\n");
    print $self->query->redirect(-location=>"/checkCookies.fcgi",-cookie=>$cookie);
  } elsif ($sid ne $self->session->id) {
    print (STDERR "sid doesn't match session id, setting cookie and sending to login\n");
    $self->cookie($cookie);
    $self->login;
  } elsif ($self->session->param('loggedIn') != 1) {
    print (STDERR "loggedIn not set to 1, sending to login\n");
    $self->login;
  } else {
    print (STDERR "looking good, sending to action\n");
    $self->action;
  }
}

changing line 4 from:
$self->session(new CGI::Session("driver:MySQL", undef, {Handle=>$self->db->dbh}));
to
$self->session(new CGI::Session("driver:MySQL", $sid, {Handle=>$self->db->dbh}));
stopped the "reuse" of the cgi object but I'm not sure why