added anonymous mode to session which allows some actions, fixed test auth for anon