As per the comment below, whether to update the session or not should perhaps depend upon `api_request?`.