I feel like I'm doing something silly causing this problem, but here goes.

I am working on setting up a python workflow/api to use the bulk api with. I have been successful in our live account with reads. But using the sandbox keeps throwing errors about  <exceptionMessage>Invalid session id</exceptionMessage> 

Here's the code.
 

#!/usr/bin/env python
import os

from time import sleep
from simple_salesforce import Salesforce
from salesforce_bulk import SalesforceBulk


password="XXXX"

# * sandbox -- True if you want to login to `test.salesforce.com`, False
#                      if you want to login to `login.salesforce.com`.
sandbox=True

username="XXX@XXXXXXXXXXXXXX.com.SANDBOX_NAME"
security_token="REDACTED"

def get_contacts(bulk):
    job = bulk.create_query_job("Lead", contentType='CSV')
    batch = bulk.query(job, "select Id,FirstName,LastName,Company from Lead")
    while not bulk.is_batch_done(job, batch):
        sleep(10)
    bulk.close_job(job)

    for row in bulk.get_batch_result_iter(job, batch, parse_csv=True):
        print row   #row is a dict


if "__main__" == __name__:
    sf = Salesforce(username=username, password=password,
                    security_token=security_token, sandbox=sandbox)
    bulk = SalesforceBulk(sessionId=sf.session_id, host=sf.sf_instance)
    get_contacts(bulk)

It authenticates and the sf object has a session/session_id. The bulk query fails with the stacktrace below. If I toggle sandbox to false and drop the sandbox name off the email address, I can run this code against production data and it works.

I'm pretty much diving right in here, so don't assume I know much about salesforce. Any feedback is appreciated. I kind of feel like there's something I'm missing with the sf_instance coming back from the login. But... I'm not sure what.
 

salesforce_bulk.salesforce_bulk.BulkApiError: [400] Bulk API HTTP Error result: <?xml version="1.0" encoding="UTF-8"?><error
   xmlns="http://www.force.com/2009/06/asyncapi/dataload">
 <exceptionCode>InvalidSessionId</exceptionCode>
 <exceptionMessage>Invalid session id</exceptionMessage>