allow returning error codes from require_valid_session to differentiate...
allow returning error codes from require_valid_session to differentiate between 401 (auth) and 403 (no blsession)
allow returning error codes from require_valid_session to differentiate between 401 (auth) and 403 (no blsession)