The order shouldn't matter. The best thing to do would be to dump the session on the success page and look at the data being passed to paypal. There must be something wrong with the syntax. If you post it here I might be able to spot the problem. Just add this to the success page:
<?php
var_dump($_SESSION);
?>
That will include the full request sent to paypal and the response. Analyzing those could lead us to the correct solution.