Change to :null_session

API calls should be stateless, POST requests shouldn't be replying on
sessions.