Add ApiController with :null_session strategy