http::redirect and http::close and not closing the session.

Ok, I think I know what the problem is... The logical expression operators have very high precendence, and as a result have confused many, many people. In your host check:

if { $host != "www.foo.com" and $host != "foo.com" }

It's very likely that the "and" is getting done differently than you expect. I will add some parenthesis to show you the way it is likely being interpreted:

if { ($host != ("www.foo.com" and $host)) != "foo.com" }

As you can see, this would definitely produce a weird and unexpected outcome.

So, try adding some parenthesis like so:

if { ($host != "www.foo.com") and ($host != "foo.com") }

and see if that doesn't help straighten out the problem.