Correctly determin when to remove a user session