answer the three refusals of the admin check alike

answer the three refusals of the admin check alike

userauth answered 402 for a session that does not exist, 403 for one that
is not an admin's and 404 for a wrong hash. Whoever reaches the control
channel could tell the three apart and so learn, session by session,
which ones are alive and which belong to an admin.

All three now answer 403 "denied". usermgmt.php, the only client, looks
for 200 and nothing else; test/nonblocking.php does not read the reply.
The reason is written to the daemon log, with the name and the ip of the
user where there is one and never the session. A malformed command still
answers 401: it says nothing about any session.

Checked with the same harness as the previous commit: a good hash answers
200, an unknown session, a non-admin and a wrong hash all answer 403
"denied", each with its own line in the log.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>