Don't require authentication for "test" environments

We use testsession to build up test state e.g. for checking
logins, so having an admin logged-in to operate the testsession
controller is counterproductive.