`Session` should use a UTC `DateTime` to evaluate "isExpired"