fix: check for session expiry is _before_ not _after_ ....