make API sessions for meteor connections client session dependand, set 'x-forwared-for' header on API calls (fixes #20)