Why don't you put the check `session[:updated_at].nil?` into the `session_expired?` method?
I'd expect a method with that name to do such a check, actually it does the opposite (`session[:updated_at] && ...`)