🐛 fix #13781 set token from environment var

lib/msf/core/web_services/json_rpc_app.rb

@@ -39,15 +39,15 @@ module Msf::WebServices
 
     before do
       db = get_db
+      @@auth_initialized = false
       if db_initialized(db)
         # store DBManager in request environment so that it is available to Warden
         request.env['msf.db_manager'] = db
         @@auth_initialized ||= get_db.users({}).count > 0
-      elsif !settings.api_token.nil?
+      end
+      if !settings.api_token.nil?
         @@auth_initialized = true
         request.env['msf.api_token'] = settings.api_token
-      else
-        @@auth_initialized = false
       end
 
       # store flag indicating whether authentication is initialized in the request environment