[jbri]

How do you tell if the user's session has expired so you know to ask them to re-authenticate before doing anything sensitive?

[kijin]

AFAIK the re-authentication thing has nothing to do with expiring sessions. The whole point is to ask users to re-authenticate even though their sessions are still alive and well. Enter your password again to change your privacy settings, etc.