Include API session route under rack protection

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>