code: @Override
      public Set<String> doGetExpired(final Set<String> candidates) {
          final long now = System.currentTimeMillis();
          Set<String> expired = new HashSet<>();
  
          // iterate over the files and work out which have expired
          for (String filename : sessionFileMap.values()) {
              try {
                  long expiry = getExpiryFromFilename(filename);
                  if (expiry > 0 && expiry < now) {
                      expired.add(getIdFromFilename(filename));
                  }
              } catch (Exception e) {
                  log.warn(e.getMessage(), e);
              }
          }
  
          // check candidates that were not found to be expired, perhaps
          // because they no longer exist and they should be expired
          for (String c : candidates) {
              if (!expired.contains(c)) {
                  // if it doesn't have a file then the session doesn't exist
                  String filename = sessionFileMap.get(c);
                  if (filename == null) {
                      expired.add(c);
                  }
              }
          }
  
          // Infrequently iterate over all files in the store, and delete those
          // that expired a long time ago.
          // If the graceperiod is disabled, don't do the sweep!
          if (gracePeriodSec > 0 &&
                  (lastSweepTime == 0L ||
                          ((now - lastSweepTime) >= (5 * TimeUnit.SECONDS.toMillis(gracePeriodSec))))) {
              lastSweepTime = now;
              sweepDisk();
          }
          return expired;
      }
docs: Check to see which sessions have expired.
  
  @param candidates the set of session ids that the SessionCache believes
  have expired
  @return the complete set of sessions that have expired, including those
  that are not currently loaded into the SessionCache