code: function shouldTouch(req) {
        // cannot set cookie without a session ID
        if (typeof req.sessionID !== 'string') {
          debug('session ignored because of bogus req.sessionID %o', req.sessionID);
          return false;
        }
  
        return cookieId === req.sessionID && !shouldSave(req);
      }
docs: determine if session should be touched