Cookies disabled results in loss of session (no workaround via Header)

It looks like express-session relys strictly on cookies. In cases where third party cookies are disabled (IE/safari by default) or cookies disabled there is no workaround to send a custom header to be handled to set the session ID.

For custom middleware that triggers before express-session we can set req.sessionID via a header or other option, but it will be overriden here:
https://github.com/expressjs/session/blob/master/index.js#L179

How about a way to take headers? Or at least look to see if sessionID is already defined?