secure api with both session and bearer