Return early from ServeHTTP to prevent NotFoundHandler being called as well.
Set MaxAge session option on current session rather than assigning a new one.