The if state that tests whether the session is valid is flawed.  Removed the "AND _state is not expired", as it would always return false under normal session operations.