Moved staff fingerprint checking out of login_session_refresh