session: Create a session object even when the user is accessing the panel through the API

Currently, flashed messages are just thrown away when the API is accessed, and those messages are important.

However, while I've looked around the panel, both inside and outside, I can't tell if this will cause issues with anything important in the panel - it will expose api keys of users to administrators if the keys are used (instead of session challenges), but that shouldn't cause any issues since they can manage accounts anyway.

I don't see why this would mess with any logged-in only features in any way, but I figure it's safer to ask.