User credentials are now stored in session. If a REST call is made
with a valid session ID cookie, the session credentials are used to
auth with the REST the API. If no valid session ID is present,
HTTP basic auth is used.