Pass sso token to REST API (via query parameter, or in a cookie).