Return the session token in the login response instead of a cookie, and accept it as a Bearer token without CSRF.