Check when a session expires

Nothing read the expiry signed into a granted session. validate_value
treats 0 as never expiring, so a login that signed its session with 0
passed, since the Max-Age the browser is told comes from set_cookie
alone. The expiry second itself is now held to be too late, with the
clock held still, as a comparison of < instead of <= passed too.

0 files changed, 0 insertions, 0 deletions