We don't need this internal method to contain the boolean argument: -

private IdentityCache createIdentityCache(HttpServerRequest request, boolean createSession) {

A subsequent call to put is sufficient for us to know a session is needed, an all other cases don't create the session.