via curl, or via some rest client that may be storing cookies? I believe it's still a proper session that gets session/auth cookies