Encapsulate session creation,
JSON API sends with method BYPS and not POST (deny CSRF)