Fix API session based auth