Use session + csrftoken instead of auth token