more work on webserices, add ta=get_token to get webservices token for supplied username
check permission (valid()) and replace code to check if admin logged in (isadmin())