Use session_id for authentication

 - With protect_from_forgery we must provide session_id for api authentication