Token checking will always fail for session that exceeds maxtime, so consider a non-authenticated session for purposes of token checking