A WebSocket reconnect is not a standing authorization grant

Clients drop and reconnect all the time. Replaying the same ticket, cookie, or “already authorized” flag from the previous socket is how revoked users keep receiving live updates they should no longer