Identity: fix is_expires to actually work.

Previously, the "final" session expiry check was precisely backward, leading to
sessions appearing to expire at "odd" times.

Also reversed the "sense" of the method: by default sessions haven't expired
unless they pass one of the expiry checks. Makes the method a bit easier to
read.