getSession deosn't call the db 99% of the time. /refreshSession will yield a new token in db like you say