SIS API — POST /api/sis/login, then /api/sis/* with session cookie