API authentication via GET or Cookie