code: func (h *Handler) AuthenticateRequest(w http.ResponseWriter, r *http.Request, checkBearerToken bool) (*SessionContext, error) {
  	const missingCookieMsg = "missing session cookie"
  	logger := log.WithFields(log.Fields{
  		"request": fmt.Sprintf("%v %v", r.Method, r.URL.Path),
  	})
  	cookie, err := r.Cookie("session")
  	if err != nil || (cookie != nil && cookie.Value == "") {
  		if err != nil {
  			logger.Warn(err)
  		}
  		return nil, trace.AccessDenied(missingCookieMsg)
  	}
  	d, err := DecodeCookie(cookie.Value)
  	if err != nil {
  		logger.Warningf("failed to decode cookie: %v", err)
  		return nil, trace.AccessDenied("failed to decode cookie")
  	}
  	ctx, err := h.auth.ValidateSession(d.User, d.SID)
  	if err != nil {
  		logger.Warningf("invalid session: %v", err)
  		ClearSession(w)
  		return nil, trace.AccessDenied("need auth")
  	}
  	if checkBearerToken {
  		creds, err := roundtrip.ParseAuthHeaders(r)
  		if err != nil {
  			logger.Warningf("no auth headers %v", err)
  			return nil, trace.AccessDenied("need auth")
  		}
  
  		if subtle.ConstantTimeCompare([]byte(creds.Password), []byte(ctx.GetWebSession().GetBearerToken())) != 1 {
  			logger.Warningf("Request failed: bad bearer token.")
  			return nil, trace.AccessDenied("bad bearer token")
  		}
  	}
  	return ctx, nil
  }
docs: // AuthenticateRequest authenticates request using combination of a session cookie
  // and bearer token