Add non-user based session support

[hugorodgerbrown]

The previous LOGIN_MODE_SESSION style was attached to a user, and would authenticate them on their behalf (which has all sorts of security issues - see #42). This is pending deprecation, but there is value in a non-user backed session token - that would persist and allow anonymous users to perform multiple actions as part of a session.