(session[TS_KEY] is already stored in "exp")