Restore allowRequestsWithoutSession to resources.xml

Otherwise that property is not read from the bigbluebutton.properties file.
It was removed in an overzealous deletion in
https://github.com/bigbluebutton/bigbluebutton/pull/11008/commits/418fdb1a318a9d6524d0250485750109883acd82