Fixes: Returning 403 from non-auth messages would trigger retrying login, even for non-authed users

This would result in a crash if no username was set.  In this case, if
the session has not initiated a login (AuthStateNoAuth) it will not try
to login again.