JIRA creates sessions for "stateless" requests

JIRA creates a session for every request that does not already belong to a session. This creates problems on servers where the REST and SOAP APIs are used extensively.

With the REST API we encourage people to use BASIC authentication, which is supposed to be stateless. However, we end up creating a new session for each request that is authenticated with basic. This can strain the server unnecessarily.

See JRJC-47 for a case where this has been reported. To fix this we need to make at least the following changes:

• JIRA should not create a new session for requests that authenticate using basic auth
• JIRA should not create a new session for unauthenticated REST requests