Check the deadline independently from securecookie

server/login/login.go

@@ -162,6 +162,11 @@ func (l *Login) fetchOrInitSession(req *http.Request) *loginSession {
 	if err != nil {
 		return new(loginSession)
 	}
+	// Check our own Deadline anyway (for authenticated sessions), do not
+	// necessarily trust the securecookie.
+	if !session.Deadline.IsZero() && time.Now().UTC().After(session.Deadline) {
+		return new(loginSession)
+	}
 	return session
 }