REST endpoint to activate/deactivate session