Only set cookie header on API requests when one was passed in

We don't send Vary: Cookie headers ourselves, but it seems to be well possible
that our Varnish config (by using various MW defaults) varies on cookies by
default. That would explain the cache misses on selser that we are seeing in
production.

Change-Id: Id28070fce871c51b80a9c443cf4bdd790e903449