mail.api abuse control via session