IMO For starting a session with symfony, the url for the HEAD request must be under the firewall, otherwise, it will cache a hash without session, and we will never had a Cookie unless a POST/PUT (not cached) request is made.

But we need to test this with session start, my brain is actually not at 100% to see how all the thing will work with Set-Cookie / Cookie / start session and all this.

However, i'm pretty confident as i already have test the old method (remove / insert cookie) with a symfony application which worked perfectly.