fix(security): require an exact SSE completion sentinel (#2422)