core: controller_comet should respond with 403 when there is no session to connect to