Checking authorization information from a cached token at session start

Fixed

• SessionConnect no longer accepts a token whose player no longer exists. A JWT is stateless, so wiping the auth store left valid tokens in client hands: the transport trusted the sub claim and entity grains lazily created empty state under a PlayerId nobody could log in as again — an orphan profile with no auth record, until the access token expired.