Wip fs cmds

This comment is incorrect. A MonSession is a session struct the monitor holds, not a session to a monitor. What we're actually doing is refusing access if we don't have a MonSession (and, thus, user auth bits to check against) for the given message. This case generally shouldn't happen; I actually can't remember when it would.