docs: public boolean isValid(HttpSession sess, HttpServletRequest req, boolean create)
    {
      // create local variable - JIT performance improvement
      final boolean isTraceOn = com.ibm.ejs.ras.TraceComponent.isAnyTracingEnabled();
      if (isTraceOn && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
      {
        LoggingUtil.SESSION_LOGGER_CORE.entering(methodClassName, methodNames[IS_VALID]);
      }
  
      ISession isess = ((SessionData) sess).getISession();
      boolean valid = isess.isValid();
      if (valid)
      {
        if (_smc.getIntegrateSecurity())
        {
            try {
                checkSecurity((SessionData)sess, req); // PK01801 check security here - 
                                                       // may result in UnauthorizedSessionRequestException
            } 
            catch (UnauthorizedSessionRequestException unauthException) {
                if (_smc.getInvalidateOnUnauthorizedSessionRequestException()) {
                    valid = false; //let the getSession code handle the invalidation
                } else {
                    if (create || _smc.getThrowSecurityExceptionOnGetSessionFalse()) {
                        throw unauthException;
                    } else {
                        //don't throw the exception if they just requested it with getSession(false)
                        valid=false;
                    }
                }
            }
        }
        if (valid && (_smc.isDebugSessionCrossover()) && (crossoverCheck(req, sess) )) { //PK80539
          valid = false;
          Object parms[] = new Object[] { getAppName(), sess.getId(), getCurrentSessionId() };
          // Needed to create a LogRecord so we could have parameters and a
          // throwable in the same log
          LoggingUtil.logParamsAndException(LoggingUtil.SESSION_LOGGER_CORE, Level.SEVERE, methodClassName, methodNames[IS_VALID], "SessionContext.CrossoverOnRetrieve", parms,
                                            new SessionCrossoverStackTrace());
        }
      }
      if (!valid) // if the session is not valid, then most likely we were processing it on the current thread and then it was invalidated by another thread.
      {
        ((IExtendedRequest) req).setSessionId(null);
        SessionAffinityContext sac = getSessionAffinityContext(req);
        sac.setResponseSessionID(null);
        /* PM73188 - Fixing regression from PM87133. Some customers were seeing a negative active count due to isValid being called multiple times in a row.
        * If the customer still needs this setting on, then they need to set ModifyActiveCountOnInvalidatedSession="true" in server.xml.
        */
        if (_smc.getModifyActiveCountOnInvalidatedSession()) {
            _coreHttpSessionManager.getIStore().getStoreCallback().sessionReleased(isess); // PM87133, since the session is no longer valid, it's also no longer active, we need to decrement active count
        }
      }
      if (isTraceOn && LoggingUtil.SESSION_LOGGER_CORE.isLoggable(Level.FINE))
      {
        LoggingUtil.SESSION_LOGGER_CORE.exiting(methodClassName, methodNames[IS_VALID], "" + valid);
      }
      return valid;
    }