@zwn If `session_expires` isn't checked anywhere then that's a bug and a security issue.