The plug was incorrectly placed in the endpoint, causing it to run on all requests including APIs. Moved to :browser pipeline where it belongs, and removed redundant fetch_session call since the pipeline handles it.
