Catch the exception in checksession() rather than disable with parameter.
Rework checksession()

* Check age of session:
* Reject if >1h unused.
* Refresh every 5m.
* Delete old sessions.