I'm pretty sure API requests from Javascript have a session cookie -- it's how they're authenticated!
I'm pretty sure API requests from Javascript have a session cookie -- it's how they're authenticated!