ether/etherpad-lite — pull request #1703 by mluto (2013-04-03 09:44:59+00:00)
Title: Kick the user if the deleteSession-API is called

Currently when a user already has a connection (which has been successfully authenticated) and a developer calls `deleteSession` via the API the user does not get kicked. This is because the session only gets validated once, when the `CLIENT_READY` message arrives.

This PR makes etherpad-lite validate **every** socket.io package. When the auth fails the new `accessStatus` is sent to the client which displays the normal "Your are not allowed to view this"-message.