Support for api-only apps

This change introduces support for apps that don't have a frontend (
the `gds-sso` strategy isn't needed when there aren't sessions).