Make sure that we re-check the auth rules during state resync, otherwise rejected events get un-rejected.
Richard van der Hoff