If their session doesn't have a `last_touch`, shouldn't one be added instead of silently passing? Also, since the session vars are shared space, could you prefix the key you're using with something indicating it's from this piece of middleware?