shouldnt /refreshSession be limited to only working once the previous session has expired?