I'm giving up on this. Their authentication method is more complicated than just providing the right session key. It probably involves one or more cookies, but I just don't care enough to look into it.