security patch for eligible list

if a session id is given and it doesn't exist, the message was sent to all subscribed sessions.