main: remove old access token from session only when it is expired