Only call rotate token if we have a session expiry cookie
* ClientTokenRotation: Rotate only expired tokens * Don't expose getSessionExpiry