validate does not check SessionNotOnOrAfter for expiration

[susan-hlu]

Hi, there,
I had an issue while importing this lib for our current SAML token validation. Our current lib also check SessionNotOnOrAfter for expiration. If NotOnOrAfter or SessionNotOnOrAfter is not expired, the SAML token is valid.
Do you think this is a valid request to make the changes to the following code? If not, can we add a flag to skip the following code? So we can handle the expiration logic properly in application layer.
now := sp.Clock.Now()
if now.After(notOnOrAfter) {
return ErrInvalidValue{
Reason: ReasonExpired,
Key: NotOnOrAfterAttr,
Expected: now.Format(time.RFC3339),
Actual: subjectConfirmationData.NotOnOrAfter,
}
}