Hi Sergei
You were right, they had implemented a thing called granitesessionid to identify source of HTTP request.
This did not exists in the previous buiId and I had completely overlooked that this was coming back with a different value on logon to the main page and required parameterisation.
Thanks for your help, your response prompted me to think in the right direction.