return None when secure-cookie is forged: https://github.com/facebook/tornado/commit/1ca245f0ee0d5785610e5bf90b78e3860adc9deb