Stop an attacker from closing a session that isn't theirs (#29)