handle cleanup

src/session/session_manager.go

@@ -99,7 +99,12 @@ func (manager *SessionManager) GetSession(r *http.Request) (*SessionData, error)
 	if err != nil {
 		return nil, ErrSessionNotFound
 	}
-	// TODO: handle token expiry here
+
+	if time.Now().After(data.ExpiresAt) {
+		_ = manager.store.Delete(token)
+		return nil, ErrSessionExpired
+	}
+
 	return data, nil
 }