added async var to api model, removed async check from apikey class
session get privilege method, session static methods check if logged in and return appropriate anon vars if not