code: async function loadSession(req, getJWT) {
  	const headerKey = this.jwt.headerKey.toLowerCase()
  
  	// Get token
  	let token
  	if (typeof getJWT === 'function') {
  		token = getJWT(req)
  	} else if (req.headers && req.headers[headerKey]) {
  		const parts = req.headers[headerKey].split(' ')
  		if (parts.length === 2 && /^Bearer$/i.test(parts[0])) {
  			token = parts[1]
  		} else {
  			throw new HttpError('credentials-bad-schema', 401, { message: `Format is ${headerKey}: Bearer [token]` })
  		}
  	}
  	token = sanitizeToken(token)
  
  	// if no token, answer directly
  	if (!token) {
  		throw new HttpError('credentials-required', 401)
  	}
  
  	// Verify token
  	let session
  	try {
  		session = await cb(jsonwebtoken.verify, token, this.jwt.secret)
  	} catch (err) {
  		throw new HttpError('invalid-token', 401)
  	}
  
  	// Verify session.userId
  	if (!session.userId) {
  		throw new HttpError('session-has-no-userId', 401)
  	}
  
  	// Add session to req.session
  	req.session = session
  }
docs: /*
  * Load the session into req.session