hmm I think that if the cookie is the empty string (and thus `session_data` is nil) it might error without `session_data &&`.  I'll play around with the tests again in a bit.