Parse data._query.session_id as a signed cookie