monitor websockets if using add_to_session
unset cookie if bad SID given