Forget what i say, it's good with this line 

```
if (req.restarts == 0 && req.http.cookie && (req.request == "GET" || req.request == "HEAD")) {
```

So the hash request is only called when session is start (as we need a cookie)

Do we transform this into a (req.http.cookie || req.http.Authorization) by the way ?