fix api authentication

nothing is stored in env[action_dispatch.request.unsigned_session_cookie]