We need to think about all logs and especially about the log level. For example, all unauthenticated requests currently log `cookie validation failed: session cookie not found` (log level: `warn`).