Authentication

• Session cookie: send Cookie: sessionid=<value> (or site-specific session cookie) on authenticated endpoints.

• CSRF protection: for unsafe methods (POST/PUT/PATCH/DELETE) include X-CSRFToken with the token issued by the site.