[MatthewWegner]

Thanks for the tip! I got this working now. Our solution looks like:

// if we're logged in, override cookies so vB will log us in properly
if(App::$playerIsRegistered)
{
	$vbUser = App::$player->getVBulletin();
	$_COOKIE['bbuserid'] = VBHelpers::GetUserID($vbUser);
	$_COOKIE['bbpassword'] = VBHelpers::GetCookiePassword($vbUser);
}
else
{
	$_COOKIE['bbsessionhash'] = '';
	$_COOKIE['bbuserid'] = '';
	$_COOKIE['bbpassword']= '';	
}

I'm not actually setting real browser cookies, just overriding PHP's internal arrays (this is hooked into init_startup, so it's before vB ever reads them). I still need to work out a solution for actions that require double logins--deleting a bunch of threads at once as a moderator, for instance--but this is a great start.

(Note to anyone finding this thread via a search later--the App/VBHelpers classes are from our own framework, and are not a part of vBulletin).