don't throw (and kill server) on session error, just log and deny access