add anonymous user session when no token, allow user admin to users other than admin if they have iorio.adminusers