We have a similar environment setup Scott describes in this following post - Development does not have SSL, UAT and Production do have SSL. We experienced similar problems with timeouts as well. I thought I would reference this for others that may come across this.
via [Scott Hanselman]
“Someone logs into an ASP.NET application successfully and does some stuff. They wait for 10.5 minutes. That means no clicking, just waiting. Then they click and get the next page successfully. Then the click on the NEXT (the second since they've been waiting) and get kicked out to the login page.”
Find the steps involved in finding the problem and resolution at the following url...
» Weird Timeouts with custom ASP.NET FormsAuthentication