make sure api is at the start of the URI before disabling sessions