Ensure currentSession is valid and not expired

[retog]

The session returned by currentSession may or may no longer be valid. In the latter case web requests will return 401. It would be handy to have a session.isValid() function that returns true if the session is still valid and false otherwise.

[RubenVerborgh]

I'd suggest that we instead only return a valid session. We depend on token renewal here, however.