Update index.js

remove redis and tweak some bevaiours. Allow token bearer witout session more powers