If you try to use roles-based security under an application with a name that contains a space, you will get the following error:

The string "COOKIE.CFAUTHORIZATION_Testnew 2" is not a valid ColdFusion variable name.

The fix, of course, is to not use an application name with a space in it, but since Session variables work fine under this name, it may not be so obvious.