For session auth, require only 'session' param, not cookie

JS code on other sites can't access the cookie anyway, so checking for
its presence in the parameter is sufficient, and this allows testing
when the website and API aren't under the same domain.