User tests: Successful: Unsuccessful:
The _state test in the "get" method is flawed. Under normal session
operation, the _state is active, and pending logout or an expiration it will
remain active. The if-test in question tests whether the session is not active
AND not expired, and upon evaluating to true will return NULL (I see there is a
note for a more robust error message in the future, but that doesn't help me
today). Under normal operations, for example a user browsing the website, _state is active.
Turns out _state wasn't populating properly because it wasn't being instantiated the right way.