pub fn session_key_from_headers(headers: &HeaderMap) -> Option<Vec<u8>>
Decode the base64-encoded session key from the cookie; return the key bytes