I mean, if the session token basically never expires it's kind of fine?