Don't save IP/browser in API-based session refresh.