PHPUnit 13 warns about mock objects with no expectations. createStub() avoids the notice since the handler is never called in the expired-session test.
Red phase: AuthMiddlewareTest covers valid cookie, missing cookie, empty cookie, unknown token, expired session, and expired session deletion.