only use the cookie session for the ui endpoints