Move apiClient AJAX calls to RESTful IDs, always pass session via cookie