    public function __construct(Database $database, $cookiePrefix = '')
    {
        parent::__construct($database, TBL_SESSIONS, 'ses');

        // determine session id
        if (array_key_exists(COOKIE_PREFIX . '_SESSION_ID', $_COOKIE)) {
            $sessionId = $_COOKIE[COOKIE_PREFIX . '_SESSION_ID'];
        } else {
            $sessionId = session_id();
        }

        $this->cookieAutoLoginId = $cookiePrefix . '_AUTO_LOGIN_ID';

        if (is_int($sessionId)) {
            $this->readDataById($sessionId);
        } else {
            $this->readDataByColumns(array('ses_session_id' => $sessionId));

            if ($this->newRecord) {
                // if PHP session id was commited then store them in that field
                $this->setValue('ses_session_id', $sessionId);
                $this->setValue('ses_timestamp', DATETIME_NOW);
            }
        }

        // check for a valid auto login
        $this->refreshAutoLogin();
    }
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."