When logging into the API, don't use the django.contrib.auth login() method as that uses state that is stored on the request and could lead to bad things. Just make a new raw session which doesn't use the HTTP request object.