'validateId' is called after 'open' and before 'read' to validate the session id provided by the client, as 'open' -> 'validateId' -> 'read' -> 'write' -> 'close' are called in sequence.
If 'validateId' returns false, a new session id will be generated, the session cookie will also be updated afterwards.