diff --git a/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js b/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js
index 58e19ee127..2b98af9579 100644
--- a/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js
+++ b/test/api/v3/integration/challenges/GET-challenges_challengeId_export_csv.test.js
@@ -40,6 +40,7 @@ describe('GET /challenges/:challengeId/export/csv', () => {
 
   it('fails if challenge doesn\'t exists', async () => {
     user = await generateUser();
+    user.get('/user');
     await expect(user.get(`/challenges/${generateUUID()}/export/csv`)).to.eventually.be.rejected.and.eql({
       code: 404,
       error: 'NotFound',
@@ -49,6 +50,7 @@ describe('GET /challenges/:challengeId/export/csv', () => {
 
   it('fails if user doesn\'t have access to the challenge', async () => {
     user = await generateUser();
+    user.get('/user');
 
     await expect(user.get(`/challenges/${challenge._id}/export/csv`)).to.eventually.be.rejected.and.eql({
       code: 404,
diff --git a/test/helpers/api-integration/requester.js b/test/helpers/api-integration/requester.js
index 93ad503e38..312942c194 100644
--- a/test/helpers/api-integration/requester.js
+++ b/test/helpers/api-integration/requester.js
@@ -64,13 +64,6 @@ function _requestMaker (user, method, additionalSets = {}) {
             return reject(parsedError);
           }
 
-          // if any cookies was sent, save it for the next request
-          if (response.headers['set-cookie']) {
-            additionalSets.cookie = response.headers['set-cookie'].map(cookieString => {
-              return cookieString.split(';')[0];
-            }).join('; ');
-          }
-
           resolve(_parseRes(response));
         });
     });
diff --git a/website/server/middlewares/api-v3/auth.js b/website/server/middlewares/api-v3/auth.js
index 2fbe437068..0feb73a98d 100644
--- a/website/server/middlewares/api-v3/auth.js
+++ b/website/server/middlewares/api-v3/auth.js
@@ -41,7 +41,14 @@ export function authWithHeaders (optional = false) {
 export function authWithSession (req, res, next) {
   let userId = req.session.userId;
 
-  if (!userId) return next(new NotAuthorized(res.t('invalidCredentials')));
+  // Always allow authentication with headers
+  if (!userId) {
+    if (!req.header('x-api-user') || !req.header('x-api-key')) {
+      return next(new NotAuthorized(res.t('invalidCredentials')));
+    } else {
+      return authWithHeaders()(req, res, next);
+    }
+  }
 
   return User.findOne({
     _id: userId,
@@ -60,8 +67,13 @@ export function authWithUrl (req, res, next) {
   let userId = req.query._id;
   let apiToken = req.query.apiToken;
 
+  // Always allow authentication with headers
   if (!userId || !apiToken) {
-    throw new NotAuthorized(res.t('missingAuthParams'));
+    if (!req.header('x-api-user') || !req.header('x-api-key')) {
+      return next(new NotAuthorized(res.t('missingAuthParams')));
+    } else {
+      return authWithHeaders()(req, res, next);
+    }
   }
 
   return User.findOne({ _id: userId, apiToken }).exec()