http://lomteqnxehqjdemqgzse7xchjlusgnpoxq2fpmz3yuukyfzc22t5gwyd.onion/jira_projects/browse/LOC-14.html
When a de-authorised client's request comes in, we should check FailureStates to see if their username and room ID are in there. If it is, we should return a HTTP 200 with the JSON payload set to report the reason for the failure (maybe just "status":"kicked" etc). We should then delete that row, so that on the next request (if there is one) the client receives a HTTP 403 (as now).