Allow session authentication for API