Use JSESSIONID

[tokeefe]

Every REST API request to XNAT 1.5+ i.e., /data/anything, creates a new server-side session. By default, once a single user has created 1000 sessions, subsequent requests will be turned away with HTTP 401/Unauthorized.

This can be prevented by issuing a GET request to /data/JSESSION, which will return a token that can be passed back to XNAT within a cookie named JSESSIONID.