The problem is that when you first hit /auth you get a new session...but nothing ever puts a user in it.

Then when come around again to go to /issue Seraph sees that you have a session but finds no user in it...then it doesn't bother to look at the cookie. Seraph should probably be looking at the cookie in this case rather than the session. (But we do it in that order because we optimise for the common case.)

jira-rest-plugin's problem is that using LoginService doesn't do all the same stuff that the DefaultAuthenticator does. We need to switch to the DA (or something similar).