Changed from checking header value to using force_preemptive_auth flag parameter. Flag is False by default, set to True on the /data/JSESSION call.