diff --git a/lib/server/hapi_plugins/api/internals.js b/lib/server/hapi_plugins/api/internals.js
index <HASH>..<HASH> 100644
--- a/lib/server/hapi_plugins/api/internals.js
+++ b/lib/server/hapi_plugins/api/internals.js
@@ -38,7 +38,9 @@ module.exports = {
         return;
       }
 
-      if (Array.isArray(res.headers['set-cookie'])) {
+      var isSess = request.method === 'post' && request.path === '/_api/_session';
+
+      if (data && isSess && Array.isArray(res.headers['set-cookie'])) {
         data.bearerToken = extractToken(res.headers['set-cookie']);
         delete res.headers['set-cookie'];
       }
fix(api): send bearer token only on session request

* * *

This commit was sponsored by The Hoodie Firm.
You can hire The Hoodie Firm:

<URL>