Allow annonymous users to create sessions

pwd/session.go

@@ -61,10 +61,14 @@ type SessionSetupInstanceConf struct {
 func (p *pwd) SessionNew(ctx context.Context, config types.SessionConfig) (*types.Session, error) {
 	defer observeAction("SessionNew", time.Now())
 
-	if _, err := p.UserGet(config.UserId); errors.Is(err, userBannedError) {
+	// Annonymous users should be also allowed to login
-		return nil, &AccessDeniedError{err}
+	if config.UserId != "" {
-	} else if err != nil {
+		if _, err := p.UserGet(config.UserId); errors.Is(err, userBannedError) {
-		return nil, err
+
+			return nil, &AccessDeniedError{err}
+		} else if err != nil {
+			return nil, err
+		}
 	}
 
 	s := &types.Session{}