API authentication with the JSESSIONID cookie