Or wait, perhaps I'm wrong; could this also catch `InvalidSessionKey`?