Refactor session id collection into one place; don't crash if anonymous
Refactor to give the auditer access to 'app', so it can access config etc.