TRACKERS.public is now null, defaults to false.
Obey auth when fetching events related to trackers/sessions
Fetching sessions obeys authorization.
Expose TRACKERS.public in REST api.