anchor.diff:        FAuthServer.HandleRequest(AContext, request, session, response)
       else if request.Document = '/' then
         ReturnProcessedFile(response, session, '/hompage.html', AltFile('/homepage.html'), true)
  -    else if OWinSecurity and (request.Document = FSecurePath+OWIN_TOKEN_PATH) then
  -      HandleOWinToken(AContext, true, request, response)
       else
       begin
         handled := false;
  
positive.code:       if request.RawHeaders.Values['Access-Control-Request-Headers'] <> '' then
          response.CustomHeaders.add('Access-Control-Allow-Headers: '+request.RawHeaders.Values['Access-Control-Request-Headers']);
      end
      else if FileExists(AltFile(request.Document)) then
        ReturnSpecFile(response, request.Document, AltFile(request.Document))
      else if request.Document.EndsWith('.hts') and FileExists(ChangeFileExt(AltFile(request.Document), '.html')) then
  
negative.code:   session := nil;
    MarkEntry(AContext, request, response);
    try
      if (request.AuthUsername = INTERNAL_SECRET) then
        FServerContext.SessionManager.GetSession(request.AuthPassword, session, check);
      if (session = nil) then
      begin
        c := request.Cookies.GetCookieIndex(FHIR_COOKIE_NAME);
        if c > -1 then
          FServerContext.SessionManager.GetSession(request.Cookies[c].CookieText.Substring(FHIR_COOKIE_NAME.Length+1), session, check); // actually, in this place, we ignore check.  we just established the session
      end;
  
      if OWinSecurity and ((session = nil) and (request.Document <> FBasePath+OWIN_TOKEN_PATH)) then
      begin
        response.ResponseNo := 401;
        response.ResponseText := 'Unauthorized';
        response.ContentText := 'Authorization is required (OWin at '+FBasePath+OWIN_TOKEN_PATH+')';
        response.CustomHeaders.AddValue('WWW-Authenticate', 'Bearer');
      end
      else if (request.CommandType = hcOption) then
      begin
        response.ResponseNo := 200;
        response.ContentText := 'ok';
  