I'd also put `Setting.session_ttl.to_i >= 5` there, and probably also `Setting.session_ttl_enabled?`, so a session never expires when session expiry is disabled.