That looks correct... what about the pp_confirm.php page... can I see a copy of that?
The next step is to add debug code to the failure page like:
<?php
var_dump($_SESSION);
die();
?>
That will give us more information about exactly where and why it is failing.