Use new `CurrentUserMode.bypass_session!` method to ignore sessions in
both sessionless and API endpoints for admin mode