No problem, @simon20.
What you are seeing is expected, right? The session will go away once the user logs out and the code should not be able to get the access token afterwards. You should ideally do that with a try/catch and handle the scenario when the user attempts to access the page while not logged in.