// since we verified this sessionID, we can also set
// it and adjust the session
request.setSession( sess );
request.setSessionId( sessionId );
sess.touch( System.currentTimeMillis() );
// if the session was NEW ( never accessed - change it's state )
if( sess.getState() == ServerSession.STATE_NEW ) {
sess.setState( ServerSession.STATE_ACCESSED, request);
}