problem

Using the session api endpoint to authenticate a user when the request already has a appToken leads since translate5-6.8.0 to the severe problem that the user is authenticated as the API user instead the desired one.

urgent solution

1. revoke the change introducing the problem
2. fix the problem with the internal session unique id causing the above fix
3. reset the session when using the API endpoint auth

other todos

• ensure that all auth mechanisms can not be used anymore when an app token is delivered → breaking change
• ensure that all auth mechanisms have for sure a fresh session
• clean up and finalize the hotfixes: what is with the update session feature now just commented out in postAction
• revoke the return value of handleAuthToken and clean up hotfix in Resource/Session.php::init
• ensure an error is thrown when two authentications are passed to the app at the same time (sso, app-token, user/password) -> breaking change