Authenticated Sessions at the HTTP level for the iControl API (HTTP Headers?)

Assuming your client making the call supports cookies. Many programatic interfaces do not generally support cookie handling so you would have to capture the returned cookie with your code and ensure you resend it in subsequent iControl requests for this to work.