#546 don't checkSessionKey if Session not started - #454 refactor
init/startup/get external auth components