Admin only auth middleware changes

- add middleware for skipping session auth when request is for api urls
- check in bb_accounts middleware for no user property on request
Hmmmm, I guess with the session auth it will create an anonymous user so there is always one associated with a request. This is going to be an issue with anon donations I think :-(