Admin only auth middleware changes

- add middleware for skipping session auth when request is for api urls
- check in bb_accounts middleware for no user property on request
Strange that this would result in an error. I assume that is why you changed this?