Update: Since doing some more investigation, I'm updating this question.
We're seeing some strange behaviour on our site for Safari users who are in private browsing mode. Our site is in an iframe which is on a different domain to the main window.
It seems like our cookies are being blocked by Safari when in private mode.
Interestingly, if the cookies already exist (ie. if we login through the main window, and then go to this page) then it allows the cookies and you can see them in the web inspector. But if you try to log in through this iframe when in private mode, the login fails, and it appears to be because Safari is blocking the cookies.
Is this a private browsing setting which can be changed perhaps? The information I've found about how private browsing affects the way Safari treats cookies has been inconsistent.
Any information or ideas that anyone has would be much appreciated.