Allow for "unmanaged" UserSessions where tokens are not checked for expiration

The authentication prop is required in both IAddItemDataOptions and IUpdateItemOptions which means that a UserSession has to be passed in.

This is not ideal in a server-side environment where only a token is available but not a UserSession. Would it be possible to change those two types so that authentication is optional and instead a token can be passed in through params?

In applyEdits for example, authentication is also not required and a token can be passed through directly via:

params: {
  token: 'token'
}

There it seems to be handled just fine. Maybe we could change addItemData and updateItem to be similar?

Let me know if I should make a PR.

[tomwayson]

In a call today, @patrickarlt suggested that we should instead have IRequestOptions have authentication: IAuthenticationManager | string, and w/in request(), we’d check to see if typeof authentication === 'string' and if so we just assume you know what you’re doing and we assume it’s a valid token.

[patrickarlt]

The more I think about this the more I like just allowing token without any other properties.

import { UserSession } from "@esri/arcgis-rest-auth";
import { updateItem } from "@esri/arcgis-rest-portal";

updateItem({
  item: {
    id: "3ef...",
    description: "A three hour tour"
  },
  authentication: new UserSession({
    token: "YOUR_TOKEN" // just assume this isn't expired...
  })
})

It would be pretty simple to add a case for this. I think we need to make determineOwner fetch the username from the portal if it is undefined. or possibly add a function to UserSession to fetch the username and cache it since the username for a given token will never change. I’ll make a separate issue for this.

Assigning this to myself.