Restful user authentication, sessions with sorcery