Request: POST /login username=user&password=password
Response: 302 Set-Cookie: JSESSIONID=xxxxxxx

Request: GET /protected-endpoint Cookie: JSESSIONID=xxxxxxx
Response: 200 Stuff...