Merge "API: Log non-whitelisted CORS requests with session cookies"