core active user is not set

I don't know if this is really the problem, but two bitmask.js api calls no longer work: get_token and logout. Both rely on the active user being set, so I suspect it is the same error.

Ideally, we could get rid of active user for all api calls.

(from redmine: created on 2016-10-13)