The very first time I built an authentication system, I didn't really know much about using the session - so I just stored a cookie myself, in the form of username%hashed_password - and then split them after retrieving them. However, in my authentication checks I hashed the password a second time - meaning that the value in their cookie, while the right value, would never match the value in the database.
It took me much longer than I'd like to admit to find that bug.