exclude revoked session when authenticating.
add index to revoked at.