If you use an external tool to send requests to restlets you can use the jsession cookie to send requests to the internal url