session based auth. is broken only for the /localhost, - removing 'blocker'.

detailed explanation:
=====================

REST-API introduced new functionality at #876641 to JSESSION based authentication,

if HTTP header Prefer:persistent-auth is set and client sends the Authorization header as well, - will be re-initiated new JSESSION, what is made all clients sending both Prefer and Authorization headers to get authorised again using
Authorization header and not JSESSION,

correct behaviour is:
====================

1. send Authorization & Prefer headers
2. store JSESSION returned in cookie
3. use for authorization Prefer header & JSESSION cookie

disabling session based authentication:
======================================

1. omit from request Prefer header
2. add Authorization header

Verified in sf10

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2013-0912.html