Comment by dv_dt

Revalidating session data could be a smaller surface area than validating a fresh login. But if logging in existing devices works in some cases, and doesn't in others, the failure case is more complex than just fresh logins don't work.