Changes to the session and cookie-validated API