The Session may not be migrating across the two areas - and the Redirect could be the culprit.

Bertrand Le Roy discusses this same topic in his blog and why not to use Redirects after manipulating the Session:

Bertrand Le Roy : Don't Redirect After Session Variable Changes

He presents two solutions - the first, which applies to FormsAuthentication, uses an already predefined to handle this very purpose:

FormsAuthentication.RedirectFromLoginPage("/Order")

The other solution is to overload the original version of the Redirect method, by passing false as the second parameter:

Request.Redirect("/Order",false);