Fix missing callback in SecurityManager.checkAccess

`securityManager.checkAccess` does not call the callback of its `async.forEach` when there is just one session and this one is invalid. This causes the client request to hang forever.

Note that `validSession` is still false so this change does not cause any problems further down the line, but tells the user that they don't have access instead of letting them wait forever.