Decode session-cookies in SecurityManager.checkAccess