Only use session auth for GET for remote users