is the Session.verifySession() necessary for our /refresh route? i imagine if the accessToken is expired, the verifySession call would fail