Accept both session and bearer tokens