force session for all users, even not logged in, to ensure they can save routing settings via api

src/c3nav/static/c3nav/js/api.js

@@ -10,7 +10,7 @@
 
         authenticate() {
             return fetch(this.base+'auth/session/', {
-                credentials: 'include',
+                credentials: 'same-origin',
                 method: 'GET',
             })
                 .then(res => res.json())