Session Cleanup Never Run

The implementation of hook_cron() has a few critical flaws. First, the code comment to "Run Session API hook first" implies that the session_api_session_api_cleanup() function should be run first, followed by other module cleanups. However, it simply uses array_unshift() to pop off the first item. If Flag module were to provide Session API support, it would actually become the first item in the list, since the modules are sorted alphabetically.

Secondly, the function "session_api_session_api_cleanup" is never actually run separately. So the cleanup of Session IDs never occurs.