Fixes an issue where returning 403 for non-logged-in for non-auth messages would trigger retrying login

This would result in a crash if no username was set.  In this case, if
the session has not initiated a login (AuthStateNoAuth) it will not try
to login again.