API authentication without the JSESSIONID cookie