Only add the client-side cookie if we have a session and follow the same security protections as the session middleware