nginx reverse proxy setup does not preserve session id when doing CORS requests

Here's my setup: - I have an http server implemented in nodejs that exposes api endpoints. This is reverse proxied through nginx to api.domain.com with ssl. Here's the config:

 1 server {                                                           
 2     listen 80;                                                      
 3     server_name api.domain.com;                                     
 4     access_log /var/log/nginx/api.access.log;                       
 5     location / {                                                    
 6         proxy_pass    http://127.0.0.1:3000/;                       
 7     }                                                               
 8 }                                                                   
 9                                                                     
 10 server {                                                           
 11     listen 443;                                                    
 12     server_name api.domain.com;                                    
 13     access_log /var/log/nginx/api.access.log;                      
 14     ssl on;                                                        
 15     ssl_certificate /path/to/ssl/server.crt;     
 16     ssl_certificate_key /path/to/ssl/server.key;         
 17     location / {
 18         proxy_pass    https://127.0.0.1:3001/;                                
 19     }                                                              
 20 }

Then I have nginx delivering a static context file under dashboard.domain.com that is intended to consume the api from api.domain.com. Here is the setup:

  1 server {                                                                                                                                 
  2     listen 80;                                                                  
  3     server_name dashboard.domain.com;                                        
  4     root /path/to/static/site;                                                                                             
  5 }  

I want to do this using CORS, I made sure the js on the static site is sending the correct Origin header in all requests. I implemented a very simple login mechanism. Here's the coffeescript code I'm using on the api endpoint:

# server.coffee
app.configure ->
    app.use middleware.setP3PHeader()
    app.use express.bodyParser()
    app.use express.cookieParser()
    app.use express.session
      secret: conf.session.secret
      key: conf.session.key
      cookie:
          maxAge: conf.session.maxAge
    app.use express.methodOverride()
    app.use express.query()
    app.use express.errorHandler()

# routes.coffee
app.options '*', shop.cors, shop.options
app.post '/login', shop.cors, shop.login
app.post '/logout', shop.cors, shop.logout
app.get '/current-user', shop.cors, shop.current

# shop.coffee
exports.options = (req, res) ->
    res.send 200

exports.cors = (req, res, next) ->
    allowed = ['http://dashboard.domain.com', 'http://localhost:3000']
    origin = req.get 'Origin'
    if origin? and origin in allowed
        res.set 'Access-Control-Allow-Origin', origin
        res.set 'Access-Control-Allow-Credentials', true
        res.set 'Access-Control-Allow-Methods', 'GET,POST'
        res.set 'Access-Control-Allow-Headers', 'X-Requested-With, Content-Type'
        next()
    else
        res.send 403, "Not allowed for #{origin}"

exports.login = (req, res) ->
    unless req.body.email? and req.body.password?
        res.send 400, "Request params not correct #{req.body}"
    models.Shop.findOne()
        .where('email').equals(req.body.email)
        .where('password').equals(req.body.password)
        .exec (err, shop) ->
            if err? then return res.send 500, err.message
            unless shop? then return res.send 401, "Not found for #{req.body}"

            req.session.shopId = shop.id
            res.send 200, shop.publish()

exports.logout = (req, res) ->
    delete req.session.shopId
    res.send 200

exports.current = (req, res) ->
    unless req.session.shopId?
        return res.send 401, "Not logged in!"
    models.Shop.findById(req.session.shopId)
        .exec (err, shop) ->
            if err? then return send.res 500, err.message
            unless shop? then return res.send 404, "No shop for #{req.session.shopId}"

            res.send 200, shop.publish()

The problem is this: 1. I first make a call to /login and I get a new session with a logged in user (req.session.shopId) 2. Then I call /current-user but the session is gone! The session id received by the nodejs server is different and thus it creates a different session