BbSession check auth, OnDemandIndexer data check.

Use BbSession to check for the user's authenticated session instead of
the undocumented UserContext.

OnDemandIndexer will now reject files with "xid-" in its name and will
also not do anything if there are too many files to process.