Is there a chance that a user might have multiple active `session`s for the same origin? I thought that would be disallowed.