Auth fixes for user flow

- enable jwt expiration, fix Em.empty name issue and manually clear the jwt tokens
- use admin only session middleware from BB to allow different auth processes for front / backend - token versus session