As new client sessions are initially detached there's a chance they are never linked
to a user session (for example user closes browser when login page is displayed). These
client sessions are never removed. I reckon we need to have a similar garbage collection
of client sessions as we do for user sessions.