EventSource still reconnected when closed

Following the specs a connection can be closed during reconnection-timeout: http://dev.w3.org/html5/eventsource/#reestablish-the-connection

EventSource did not do this at the moment, so it wasn't possible to 'cancel' a reconnect when a remote connection was closed.
Added test to check closing on remote disconnects
Reject unauthorized requests by default