Load use from session when it exists

web/api/app/Controller/AppController.php

@@ -93,6 +93,7 @@ class AppController extends Controller {
         if ( $stateful ) {
 
           zm_session_start();
+
           $_SESSION['remoteAddr'] = $_SERVER['REMOTE_ADDR']; // To help prevent session hijacking
           $_SESSION['username'] = $user['Username'];
           if ( ZM_AUTH_RELAY == 'plain' ) {
@@ -100,6 +101,14 @@ class AppController extends Controller {
             $_SESSION['password'] = $_REQUEST['password'];
           }
           session_write_close();
+        } else if ( $_COOKIE['ZMSESSID'] ) {
+          # Have a cookie set, try to load user by session
+          if ( ! is_session_started() )
+            zm_session_start();
+          else
+            ZM\Logger::Debug(print_r($_SESSION,true));
+          $user = userFromSession();
+          session_write_close();
         }
       }
 
@@ -142,10 +151,7 @@ class AppController extends Controller {
           return;
         }
       } # end if ! login or logout
-      if ($user['APIEnabled'] == 0 ) {
-        throw new UnauthorizedException(__('API Disabled'));
-        return;
-      }
+
     } # end if ZM_OPT_AUTH
     // make sure populated user object has APIs enabled
   } # end function beforeFilter()