Description:
------------
sessions don't appear to expire when expected. for example:

a logon request arrives and the app calls session_start() and stores authentication data in the session. session.gc_maxlifetime+n seconds later, a 2nd request arrives. The authentication data is loaded and the 2nd request is processed as if the session is active. A few seconds later a 3rd request arrives; in the 3rd request all the session data is gone, as if the session only just timed out even though the user requested immediately after the 2nd response.

Apparently, php deserializes session data and does gc() (if it is to be done) afterwards; so in the 2nd request, the data is loaded into the session, *then* the files are removed.

I expected that the 2nd, not 3rd request would have no session data

Wouldn'tm it makeore  sense to gc *before* loading the session data? That way, it would be the *2nd* request to perceive a session timeout, instead of the  3rd.

Reproduce code:
---------------
I have session.gc_probability=100 and session.gc_divisor=100 to run gc on each request.



Expected result:
----------------
I expected that the 2nd, not 3rd request would have the session data not deserialized. While in practice it will usually be the case that the the gc will occur in a different users process, nevertheless, I suggest that if session_start() does a gc which results in the session data being removed, it should not also load it into the session.