It seems to me that, in most cases, cookie auth will be regularly used when contacting Koha from its UI. It might not be critical, but we should probably save some CPU cycles by checking CGISESSID first.