Nope, still didn't work. It first sets a new ticket when the client is opened, and then once the client is about half-way loaded it assigns another ticket. Not sure why it does that; I'll have to look into it.
Here's every occurrence of "ticket" in the CMS:
Code:
./client.php:$tpl->bind_param("ticket", $user->createTicket());
./application/libraries/user.class.php: public function createTicket()
./application/libraries/user.class.php: * We need to create a session ticket.
./application/libraries/user.class.php: * Generate a random ticket.
./application/libraries/user.class.php: $ticket = $GENERATE;
./application/libraries/user.class.php: * Create a Phoenix session ticket
./application/libraries/user.class.php: $process = $this->write("auth_ticket", $ticket);
./application/libraries/user.class.php: $exists = $db->query("SELECT * FROM user_tickets WHERE userid = ".$this->id);
./application/libraries/user.class.php: $db->query("UPDATE user_tickets SET sessionticket = '".$ticket."' WHERE userid = ".$this->id);
./application/libraries/user.class.php: $db->query("INSERT into user_tickets VALUES(".$this->id.", '".$ticket."', '".$_SERVER['REMOTE_ADDR']."')");
./application/libraries/user.class.php: * Create an Uber session ticket
./application/libraries/user.class.php: return $ticket;
./application/handlers/register.php: //INSERT INTO `users` (`username`, `real_name`, `password`, `mail`, `auth_ticket`, `credits`, `activity_points`, `activity_points_lastupdate`, `look`, `motto`, `last_online`, `ip_last`) VALUES ('Leon3', 'Leon Hartley', '".$password."', '".$email."', '', ".$habbo->starter_credits.", 1000, 1341150858.12091, 'ch-210-62.hd-190-1.lg-275-62.sh-290-62.hr-115-31', 'I\'m new!', '0', '".$_SERVER['REMOTE_ADDR']."', '".$_SERVER['REMOTE_ADDR']."', ".$habbo->homeroom.");
./application/templates/nova/client.tpl: "use.sso.ticket" : "1",
./application/templates/nova/client.tpl: "sso.ticket" : "#ticket#",