Should it depend upon whether or not this is an API request? What if I am accessing the API as a session user?