get should never return an expired session