I figured this out eventually. The issue is that the two machines are on different domains and so by default they can’t exchange cookies. Because my web app was hosted on a machine on a domain named nunya.int and ignition was hosted on a domain named nunya.com, the two pages couldn’t exchange cookies.
These settings in ignition.conf fixed the issue:
wrapper.java.additional.5=-Dignition.http.session.cookie.same-site.enabled=true
wrapper.java.additional.6=-Dignition.http.session.cookie.same-site.value=None
I wouldn’t recommend setting things up this way in production, but in production my web app server and my ignition server will both be on the nunya.com domain so I won’t have to.