Be easy on invalid or expired session identifiers

Why would we be so mean that we always reject invalid or expired session
identifiers by default? Creating a new fresh session is also a good
standard behavior.