WindowsIdentity.Impersonate gives "Invalid token for impersonation - it cannot be duplicated"

I have an ASP.NET app that requires users to sign in with their domain accounts using Basic Authentication. The user can make a selection, then press a button.
At some point after pressing the button is this code: WindowsIdentity.Impersonate(userIdentity.Token).
userIdentity is of type WindowsIdentity, and it was previously set to (WindowsIdentity)User.Identity.
userIdentity is stored as a session variable, and I think that's because, after the button is pressed, the page containing this code is called via AJAX.
This is being done because the next few lines of C# invoke the Exchange API via ExchangeServiceBinding using the identity of the signed-in user.
When I hit this code, it works about 2/3 of the time, but 1/3 of the time, I get this exception: Invalid token for impersonation - it cannot be duplicated. I think the biggest ...