anchor.diff:  
   /// Processes the session cookie, and on successful verification it will set the
   /// user session data.
  -shelf.Handler _userSessionWrapper(shelf.Handler handler) {
  +shelf.Handler _userSessionWrapper(Logger logger, shelf.Handler handler) {
     return (shelf.Request request) async {
       // Never read or look for the session cookie on hosts other than the
       // primary site. Who knows how it got there or what it means.
  
positive.code:     if (isPrimaryHost &&
          isAllowedForSession &&
          request.headers.containsKey(HttpHeaders.cookieHeader)) {
        final sessionId = session_cookie.parseSessionCookie(
          request.headers[HttpHeaders.cookieHeader],
        );
        if (sessionId != null && sessionId.isNotEmpty) {
          final sessionData = await accountBackend.lookupSession(sessionId);
          if (sessionData != null) {
            registerUserSessionData(sessionData);
          }
        }
      }
      shelf.Response rs = await handler(request);
  
negative.code:   handler = _userAuthWrapper(handler);
    handler =
        _requestContextWrapper(handler); // need to run after session wrapper
    handler = _userSessionWrapper(logger, handler);
    handler = _httpsWrapper(handler);
    if (sanitize) {
      handler = _sanitizeRequestWrapper(handler);
  