A session and the user it belongs to. user is null when the session outlived its user, which the caller reports and clears — never mistake it for a token nobody ever had.