Session manager for REST server without cookies