There was a bug involving local onebox, login required and subdomain, but this got fixed.
When I was debugging it I had to use a dev environment, and it was easy from there, but it was easy to reproduce.
If you can find some difference between the working instance and the other we can hunt it down.