oops, require session_api for anon api session stuff