Yes, that's an alternative. Moving these conditions into the session_expired? method means "if session expiry is turned off, sessions never expire". Now it reads more like "if session expiry is turned off, we don't check for session expiry".