tests passing...

packages/core

@@ -1 +1 @@
-Subproject commit 29318b29d35ac8d8bfb137a5e739a308e01c1829
+Subproject commit b372ad7403fa12f92670ef38e7576bc5795006e9

packages/datastores/datastores/local.js

@@ -53,7 +53,7 @@ const deleteFolder = root => async (path) =>
 
 const readableFileStream = root => async path => 
     fs.createReadStream(
-        join(root, path), "utf8"
+        join(root, path)
     );
 
 const writableFileStream = root => path => 

packages/server/middleware/routers.js

@@ -69,7 +69,11 @@ module.exports = (config, app) => {
             pathParts[1],
             ctx.sessionId);
 
-        await next();
+        if(ctx.instance === null) {
+            ctx.response.status = StatusCodes.UNAUTHORIZED;
+        } else {
+            await next();
+        }
     })
     .post("/:appname/api/changeMyPassword", async (ctx) => {
         await ctx.instance.authApi.changeMyPassword(

packages/server/tests/authenticate.js

@@ -88,7 +88,7 @@ module.exports = (app) => {
 
         await app.get("/_master/api/users/")
             .set("cookie", newUserCookie)
-            .expect(statusCodes.FORBIDDEN);
+            .expect(statusCodes.UNAUTHORIZED);
 
         await app.post("/_master/api/authenticate", {
             username: testUserName,

packages/server/utilities/masterAppInternal.js

@@ -115,15 +115,23 @@ module.exports = async (config) => {
     const getInstanceApiForSession = async (appname, sessionId) => {
         if(isMaster(appname)) {
             const customId = bb.recordApi.customId("mastersession", sessionId);
-            const session = await bb.recordApi.load(`/sessions/${customId}`);
-            return await getApisForSession(masterDatastore, session);
+            try {
+                const session = await bb.recordApi.load(`/sessions/${customId}`);
+                return await getApisForSession(masterDatastore, session);
+            } catch(_) {
+                return null;
+            }
         }
         else {
             const app = await getApplication(appname);
             const customId = bb.recordApi.customId("session", sessionId);
-            const session = await bb.recordApi.load(`/applications/${app.id}/sessions/${customId}`);
-            const instanceDatastore = getInstanceDatastore(session.instanceDatastoreConfig)
-            return await getApisForSession(instanceDatastore, session);
+            try {
+                const session = await bb.recordApi.load(`/applications/${app.id}/sessions/${customId}`);
+                const instanceDatastore = getInstanceDatastore(session.instanceDatastoreConfig)
+                return await getApisForSession(instanceDatastore, session);
+            } catch(_) {
+                return null;
+            }
         }
     };
 
@@ -162,7 +170,8 @@ module.exports = async (config) => {
                 "/mastersessions_by_user",
                 {
                     rangeStartParams:{username}, 
-                    rangeEndParams:{username}
+                    rangeEndParams:{username},
+                    searchPhrase:`username:${username}`
                 }
             );