set req._sessionBeforeBlacklist, on headers
1.1.0