Could be it, Firefox w/ Mullvad on Linux. Gets a 403 on the second /session call, first one is a 302.

Thank you, investigating this