handler: cancel unknown sessions. note: doesn't actually get used unless instance_id is nonrandom