ALLOW_API_TOKENS is always defined (see config.inc.php)
do not check for user-facebook_id, but user-role instead ...
also overwrite session data when request data is given
make smushit an external plugin
adjusted smushit dependency
Merge pull request #40 from cnlpete/release/4.1

small adjustments