Let header take precedence over cookie for sessions.