_resolve_allowed_usernames reset _username_resolved_ids only after the early return for an empty allowlist / missing client, so a reconnect after the allowlist was emptied kept the previous connect's resolved IDs in the set the gateway authz union reads. Reset first so the set always reflects the current connect.