What happens if a session requires pre-authorization but the client does not have one?