ALLOW_API_TOKENS is always defined (see config.inc.php)
do not check for user-facebook_id, but user-role instead ...
also overwrite session data when request data is given
make smushit an external plugin