Sessions: delete sessions *after* they expire

Don't delete sessions *before* they expire. Derp!

Also, missing sessions: throw a proper error message
Instead of the 'Cannot read property ast of undefined'.