Allow authentication for both session and in request

Also fix first time user's of OSPi having issues with the mobile app plugin.