code: function(callback) {
          if (res.parsedHeader.payload.mode === 'handshake') {
            res.session = {
              sid: reqSid,
              cert: senderCert,
              token: reqToken
            };
            callback(null);
          } else {
            var querySid;
            if (sessionStore instanceof Store || 'undefined' !== typeof window) {
              querySid = my.config.urlBase;
            } else {
              querySid = reqSid;
            }
            // load the session if exists
            sessionStore.load(querySid, function(err, session){
              if (err) {
                callback(err);
              } else if (session) {
                log.debug('%s loaded session', app.name);
                log.debug(session);
                res.session = session;
                callback(null);
              } else {
                callback('session expired');
              }
            });
          }
        }
docs: get sender certificate using payload cert (in handshake phase) or payload sid