we could also overwrite the req.http.cookie field if the other cookies are never relevant on the backend. instead of creating a new header, which will make it a pain for the backend to discover the session cookie. might be easier actually.