The session is missing in the RequestContext for a custom Controller

[McHunkyTrunk]

Describe the bug
When creating a new custom Controller to extend the Admin UI, the session field remains undefined within the injected RequestContext parameter for a route. With @Allow(Permission.Authenticated) route decorator, the request just fails with a 403 status code error.forbidden, although the required and valid session cookies are sent.

To Reproduce

1. Create a new Plugin:

@VendurePlugin({
  imports: [PluginCommonModule],
  controllers: [FooController],
})
export class FooPlugin {
}

2. Define the new custom Controller:

@Controller("foo")
export class FooController {
  @Get("bar")
  @Allow(Permission.Authenticated)
  bar(@Ctx() ctx: RequestContext) {
    console.log("session", ctx.session)
    console.log("isAuthorized", ctx.isAuthorized)
    
    return "success";
  }
}

3. Include the new Plugin into the Vendure config.
4. Login into the Admin UI.
5. Manually navigate to /foo/bar.

Expected behavior
The success string response is expected. Instead, a 403 error code will be sent, indicating the missing user authentication.

Environment (please complete the following information):

• @vendure/core version: 0.12.3
• Nodejs version: 12.16.2
• Database: postgres

[michaelbromley]

OK, I see that the issue occurs only when using the "cookie" tokenMethod. Hence why the e2e tests pass (the e2e tests are run with "bearer" tokenMethod).