Accept the phone's session, like every session endpoint

Shipped

November 7, 2026 at 1:23 AM UTC

Author

Kamo

Commit

0736513

SIE5. **************** read only the BFF's X-OTK session, so KamoMobile (api.<org> with X-***-Token) got 401 and could not share a preference with the web — the SI Command Center's first-time help could not be folded on every device. The caller is now resolved by CallerSessionResolver (X-OTK session, X-***-Token, *** cookie), as the other session endpoints do. Tests: header session 200, stale session 401.