Sessions of non-authenticated users expire en masse

[Jeff 'Jones' Putz]

Here's some weirdness for you. I thought I'd be clever and track
user's sessions. Application_Start creates a DataTable and dumps it in
the Application object. Then in Session_Start I put some stuff in it:

Application.Lock();
DataTable objUserTable = (DataTable)Application["UserTable"];
DataRow objRow = objUserTable.NewRow();
Guid objGuid = Guid.NewGuid();
objRow[0] = objGuid;
Session["PfSessionID"] = objRow[0];
objRow[1] = 0;
objRow[2] = false;
objUserTable.Rows.Add(objRow);
Application["UserTable"] = objUserTable;
Application.UnLock();

In Session_End I nuke the row:

Application.Lock();
DataTable objUserTable = (DataTable)Application["UserTable"];
objUserTable.Rows.Find((Guid)Session["PfSessionID"]).Delete();
Application["UserTable"] = objUserTable;
Application.UnLock();

Because I want to know when it's a specific user who's on, I check
them out here in Application_OnAcquireRequestState:

Application.Lock();
if (Request.IsAuthenticated)
{
HttpContext context = HttpContext.Current;
DataTable objUserTable = (DataTable)Application["UserTable"];
People objPeople = new People(context.User.Identity.Name);
foreach (DataRow Item in objUserTable.Select("SessionID = '" +
((Guid)Session["PfSessionID"]).ToString() + "'"))
Item.Delete();
if (objPeople.PeopleID != 0)
{
foreach (DataRow Item in objUserTable.Select("PeopleID = " +
objPeople.PeopleID.ToString()))
Item.Delete();
}
DataRow objRow = objUserTable.NewRow();
objRow[0] = Session["PfSessionID"];
objRow[1] = objPeople.PeopleID;
objRow[2] = objPeople.ShowDetail;
objUserTable.Rows.Add(objRow);
Application["UserTable"] = objUserTable;
}
Application.UnLock();

The People object has its PeopleID set to 0 if for some reason no user
record is found (from cache or DB), and that's the value given to any
request not authenticated.

Here's the weirdness though... the values in the table that have a 0
value in Row[1] (the PeopleID) all vaporize about every ten minutes
then slowly build back up to the number of non-authenticated users. I
can't for the life of me figure out why.