Better handling of unknown or expired session

Pertinent in a development (localhost) environment
where the “localhost” cookie might be shared between
multiple apps.