code: function cookieParserDecorator(req, res, next) {
      // run express.cookieParser() only when were not visiting the api.
  
      if (req.isResty) {
          // get token from headers.
          var token = req.headers[tokenHeaderName] || undefined;
          if (token) {
              try {
                  // decode token, it holds and create a fake cookie.
                  jwt.decode(req.secret, token, function (err, decode) {
                      if (! err) {
                          // set the fake cookie, it will now have a keystone session id
                          req.signedCookies = decode;
                      }
                  });
              }
              catch(ex) {
                  // when token does not parse to an object.
              }
          }
  
  
          var listenersCount = EventEmitter.listenerCount(res, 'header');
          originalSessionMiddleware(req, res, function(){
              if (EventEmitter.listenerCount(res, 'header') > listenersCount) {
                  res.removeListener('header', res.listeners('header')[listenersCount]);
              }
              next();
          });
  
      }
      else {
          // run the original cookie parser.
          originalCookieParserMiddleware(req, res, function() {
              originalSessionMiddleware(req, res, next);
          });
      }
  }
docs: Replace the default cookie parser with a proxy cookie parser middleware.
  The proxy is then used to decide what parser is right for the task.
  If we are not in the api realm, use the default cookie parser.
  In any other case, use the appropriate one.
  
  This approach is used to create fake "cookie" data.
  By faking cookie data we can use default session middleware as is without the need to replace it.
  @param req
  @param res
  @param next