anchor.diff:      if (isPrimaryHost &&
           isAllowedForSession &&
           request.headers.containsKey(HttpHeaders.cookieHeader)) {
  -      final sessionId = session_cookie.parseSessionCookie(
  -        request.headers[HttpHeaders.cookieHeader],
  -      );
  -      if (sessionId != null && sessionId.isNotEmpty) {
  -        final sessionData = await accountBackend.lookupSession(sessionId);
  -        if (sessionData != null) {
  -          registerUserSessionData(sessionData);
  +      try {
  +        final sessionId = session_cookie.parseSessionCookie(
  +          request.headers[HttpHeaders.cookieHeader],
  +        );
  +        if (sessionId != null && sessionId.isNotEmpty) {
  +          final sessionData = await accountBackend.lookupSession(sessionId);
  +          if (sessionData != null) {
  +            registerUserSessionData(sessionData);
  +          }
           }
  +      } catch (e, st) {
  +        logger.severe('Unable to process session cookie.', e, st);
         }
       }
       shelf.Response rs = await handler(request);
  
positive.code:   handler = _userAuthWrapper(handler);
    handler =
        _requestContextWrapper(handler); // need to run after session wrapper
    handler = _userSessionWrapper(handler);
    handler = _httpsWrapper(handler);
    if (sanitize) {
      handler = _sanitizeRequestWrapper(handler);
  
negative.code: 
  /// Processes the session cookie, and on successful verification it will set the
  /// user session data.
  shelf.Handler _userSessionWrapper(Logger logger, shelf.Handler handler) {
    return (shelf.Request request) async {
      // Never read or look for the session cookie on hosts other than the
      // primary site. Who knows how it got there or what it means.
  