/get-session returns 200 even if cookie is invalid - Better Auth