private void addSessionCookie(HttpServletResponse response) {
      // Don't bother if the response is already committed
      if (response.isCommitted()) {
        return;
      }

      SessionCookieConfig cookieConfig = context.getSessionCookieConfig();
      Cookie cookie = new Cookie(manager.getSessionCookieName(), session.getId());
      cookie.setPath("".equals(getContextPath()) ? "/" : getContextPath());
      cookie.setHttpOnly(cookieConfig.isHttpOnly());
      cookie.setSecure(cookieConfig.isSecure());
      response.addCookie(cookie); // lgtm [java/insecure-cookie]
      // The lgtm alert for the above line is suppressed as a false positive, since we are simply
      // using the security setting from the context's cookie config
    }
Create our own sessions. TODO: Handle invalidated sessions

@return a HttpSession
extensions/geode-modules-session/src/main/java/org/apache/geode/modules/session/filter/SessionCachingFilter.java