- API requests authenticated by token - UI requests authenticated by cookie fix #311 and #119
mentioned in issue #304 (closed)