Yes yes yes .. you're absolutely right! It was originally a check for the existence of the session cookie - but I then changed it to check for a cookie of 32 bytes in length - but made the mistake of ignoring the absence of cookie.

Thanks for your help! .. and apologies for my stupidity.