b/api: read session sets cookie