I am bootstrapping drupal 7 (using DRUPAL_BOOTSTRAP_FULL) so that I can use drupal's authentication/security features in the rapid development of a web app I'm doing a proof of concept for. (And yes I know it is better to use drush to bootstrap drupal.)
If the PHP file that I am bootstrapping drupal from is in the root drupal directory, then the bootstrapping works -- I know this because inspecting the $user global variable will show that I am logged in.
If the PHP file is not in the root drupal directory (whether a subdirectory of the root drupal directory or a sibling of the root drupal directory), then the bootstrapping works -- I can inspect the $user global variable, but the $user variable says I am an anonymous user rather than the logged in user that I am.
Is my suspicion right that this is related to the scope of the drupal session cookie? If so, what is that scope?