core/apiRouter: map blank session and user to context when not authenticated