Kick the user if the deleteSession-API is called

Currently when a user already has a connection (which has been successfully  authenticated) and a developer calls `deleteSession` via the API the user does not get kicked. This is because the session only gets validated once, when the `CLIENT_READY` message arrives.

This PR makes etherpad-lite validate **every** socket.io package. When the auth fails the new `accessStatus` is sent to the client which displays the normal "Your are not allowed to view this"-message.

Fixed #815.