if (session != null) {
httpSession = SecurityActions.forSession(session, this, false);
exchange.putAttachment(sessionAttachmentKey, httpSession);
} else if (create) {
String existing = c.findSessionId(exchange);
if (originalServletContext != this) {
//this is a cross context request
//we need to make sure there is a top level session
originalServletContext.getSession(originalServletContext, exchange, true);
} else if (existing != null) {