fixing issue #97

Now able to merge as well.
To allow for future testing, let's delete this line and move this logic into `authenticationHandler` like so:

```javascript
// If cookie session doesn't exist...
if ( !username && !!env.get( "ALLOW_QUERY_STRING_API_SYNC" ) && req.query.username ) {
...
```