docs: public MemcachedBackupSession findSession( final String id ) throws IOException {
          MemcachedBackupSession result = _manager.getSessionInternal( id );
          if ( result != null ) {
              // TODO: document ignoring requests and container managed authentication
              // -> with container managed auth protected resources should not be ignored
              // TODO: check ignored resource also below
              if (!_sticky && !_trackingHostValve.isIgnoredRequest() && !isContainerSessionLookup()) {
                  synchronized (_manager.getSessionsInternal()) {
                      // the session could have been removed in the meantime...
                      if(_manager.getSessionInternal(id) == null) {
                          addValidLoadedSession(result);
                      }
                      result.registerReference();
                  }
              }
          }
          else if ( canHitMemcached( id ) && _invalidSessionsCache.get( id ) == null ) {
  
              // If no current request is set (RequestTrackerHostValve was not passed) we got invoked
              // by CoyoteAdapter.parseSessionCookiesId - here we can just return null, the requestedSessionId
              // will be accepted anyway.
              // If form based security is used, then AuthenticatorBase.invoke might ask for the session (to get the authenticated principal),
              // in this case we must return the session because valid requests would be rejected otherwise.
              if(!_sticky && (
                      isConnectorSessionLookup()
                      || _trackingHostValve.isIgnoredRequest() && !_manager.contextHasFormBasedSecurityConstraint())) {
                  if(_log.isDebugEnabled()) {
                      _log.debug("Returning for session id " + id + " (isConnectorSessionLookup: "+ isConnectorSessionLookup() +
                              ", isIgnoredRequest: " + _trackingHostValve.isIgnoredRequest() + ")");
                  }
                  return null;
              }
  
              // else load the session from memcached
              result = loadFromMemcached( id );
              // checking valid() would expire() the session if it's not valid!
              if ( result != null && result.isValid() ) {
                  if(!_sticky) {
                      // synchronized to have correct refcounts
                      synchronized (_manager.getSessionsInternal()) {
                          // in the meantime another request might have loaded and added the session,
                          // and we must ensure to have a single session instance per id to have
                          // correct refcounts (otherwise a session might be removed from the map at
                          // the end of #backupSession
                          if(_manager.getSessionInternal(id) != null) {
                              result = _manager.getSessionInternal(id);
                          }
                          else {
                              addValidLoadedSession(result);
                          }
                          result.registerReference();
                          // _log.info("Registering reference, isContainerSessionLookup(): " + isContainerSessionLookup(), new RuntimeException("foo"));
                      }
                  }
                  else {
                      addValidLoadedSession(result);
                  }
              }
          }
          return result;
      }