code: func (s *IdentityService) UpsertWebSession(user, sid string, session services.WebSession) error {
  	session.SetUser(user)
  	session.SetName(sid)
  	value, err := services.GetWebSessionMarshaler().MarshalWebSession(session)
  	if err != nil {
  		return trace.Wrap(err)
  	}
  	sessionMetadata := session.GetMetadata()
  	item := backend.Item{
  		Key:     backend.Key(webPrefix, usersPrefix, user, sessionsPrefix, sid),
  		Value:   value,
  		Expires: backend.EarliestExpiry(session.GetBearerTokenExpiryTime(), sessionMetadata.Expiry()),
  	}
  	_, err = s.Put(context.TODO(), item)
  	return trace.Wrap(err)
  }
docs: // UpsertWebSession updates or inserts a web session for a user and session id
  // the session will be created with bearer token expiry time TTL, because
  // it is expected to be extended by the client before then