Check if user is authorized to access an application before authenticating him

src/actors/openid_sessions_actor.rs

@@ -28,7 +28,7 @@ pub struct Session {
 
 impl Session {
     pub fn is_expired(&self) -> bool {
-        self.code_expire_on < time() || self.token_expire_at < time()
+        self.code_expire_on < time() && self.token_expire_at < time()
     }
 }