Exclude the API urls from forced session based authentication
We now have token based authentication support too