[Bug]: empty primary session cookie blocks valid bearer auth #27849

Before submitting

• I searched existing issues and did not find a duplicate.
• I included enough detail to reproduce or investigate the problem.

Area

apps/server

Steps to reproduce

Send a request with an empty primary session cookie (Cookie: <primarySessionCookie>=) and a valid Authorization: Bearer <token>.

Expected behavior

Authenticate with the bearer session (same as bearer winning over a stale legacy cookie).

Actual behavior

selectRequestCredential selects the empty cookie; authenticateRequest fails with ServerAuthMissingCredentialError because !credential?.token.

Impact

Minor bug or occasional failure

Fix

#27848