I do give some preference to requests that come in with a well-formed session ID. I can't check whether it's real prior to granting the preference (the round trip is too expensive to justify in a high-load scenario, but I can check the signature validity at least.

But of course lots of legit authentication attempts come from new users, or new sessions. So I need to allow that case as well, and then we're back at square one.