Note no test here, because this early return involves HTTP-only cookies, which we don't have the infrastructure to test (we would need to support custom HTTP headers in tests).