pub fn session_tokens(headers: &HeaderMap) -> Vec<&str>Expand description
Every session token in a request’s Cookie headers, in order, at most
MAX_SESSION_COOKIES. There can be more than one: a sibling subdomain
can set a cookie of the same name for the parent domain, and the browser
may send it first. Taking only the first would let it sign the owner out.