As introduced by PLINK-400, the filter must also support stateless authentication.

When performing a stateless authentication, the session cookie (eg.: JSESSIONID) must not be present in any response from the server.