I think this clause should rather be 
```
(username = null AND sessionid = ?) OR (username = ?  AND username != null)
```

Meaning: in case the username is a valid user name, just check the json_spec. In case the username is null (= anonymous user in the new paradigm), check against the stored proxy's sessionid + the json_spec.

Maybe @pmauduit can tell us more about it.