fix api authentication

nothing is stored in env[action_dispatch.request.unsigned_session_cookie]
Merge pull request #1462 from opf/feature/fix_api_authentication

fix api authentication