sse routing via app.router

as %subj% says, this changes the way SSE requests are being routed - instead of intercepting every request and running filters on them, just go and use app.router instead. This is especially beneficial when permissions rely on requests being pre-filtered (and e.g. updated with session info) within app.router - previous approach would execute permission verification on raw requests, i.e. even before app.router is being invoked.
Additionally, for consistency 403 is reported on single model access violations, instead of previous 404, hence the change in test case.