Turns out it is only the /me endpoint that requires a user session.