code: public String getSessionUserName(HttpServletRequest request, HttpServletResponse response)
      {
          HttpSession session = null;
  
          SessionAffinityContext sac = getSessionAffinityContext(request);
  
          if (!sac.isFirstSessionIdValid() && !sac.isAllSessionIdsSetViaSet()) { //PM89885
              @SuppressWarnings("rawtypes")
              List allSessionIds = _sam.getAllCookieValues(request);
              sac.setAllSessionIds(allSessionIds);
              _sam.setNextId(sac); // we got rid of the first one in setAllSessionIds, get the next one so that we have an id to work with
          }
  
          String id = _sam.getInUseSessionID(request, sac);
  
          if (id != null) {
              session = (HttpSession) _coreHttpSessionManager.getSession(request, response, sac, false); // don't create here
          }
          if( session != null ){
              SessionData sd = (SessionData) session;
              return sd.getUserName();            
          } else{
              return null;
          }
      }
docs: /*
  Get the session. Look for existing session
  Only called this way from sessionPreInvoke as a performance
  optimization. Won't create session on this call either.