ASP.NET WIF change security token handler and avoid CryptographicException
<p>We have an ASP.NET MVC application which uses WIF and the classic <code>SessionSecurityTokenHandler</code>, which means the WIF cookie is signed using DPAPI.</p>

<p>We would like to switch the security token handler to <code>MachineKeySessionSecurityTokenHandler</code> because we want to scale our application to multiple instances (web farm) in an Azure web app deployment. This means the WIF cookie will be signed using the machine key (which is shared accross web app instances).</p>

<p>The problem we face is with users which already have a cookie initialized for the application. If we brutally change the token handler, these users will get an ugly HTTP 500 page, due to a <code>CryptographicException</code> because the cookie signature is invalid.</p>

<p>Is there a way to prevent the error and instead either discard the obsolete cookie, or let the user authenticate again?</p>