Start of API2!
(Also realised API1 should not set cookies as part of this, removed that.)