Minor quibble, since it's highly unlikely any other `SuspiciousOperation` could have been raised here, but really this should catch `SuspiciousSession`