code: func WithMaxSessionDuration(auth Authenticator, exp func() time.Time) Authenticator {
  	return AuthenticatorFunc(func(username, password, otp string) (*Session, error) {
  		session, err := auth.Authenticate(username, password, otp)
  		if err != nil {
  			return session, err
  		}
  
  		t := exp()
  		if exp := session.ExpiresAt; exp != nil {
  			if exp.Before(t) {
  				// Re-setting ExpiresAt to t would increase the
  				// expiration of this session, instead we want
  				// to keep it in tact.
  				return session, err
  			}
  		}
  		session.ExpiresAt = &t
  		return session, err
  	})
  }
docs: // WithMaxSessionDuration wraps an Authenticator to ensure that sessions always
  // have a maximum lifetime. If the Session already has an expiration that will
  // expire before d, the existing expiration is left in tact.