Discovery service assumes that we are already authenticated and bravely fires authenticated requests... but with this very request (`createSession`) it's not always the good thing, right?