REST Service uses CSP license session after Upgrade from Caché to IRIS

After installing IRIS 2023.1 on a live copy of our production machine our REST Service now consumes a CSP Session with every request. The request is handled as expected, but uses one of the 5 CSP Session per license. So after 25 requests, the license is used up. The Grace time always shows 0 and the session stay for very long. (Maybe the 900 Seconds timeout). 
On Caché 2018, we had the same settings for the Webapp and there, only a single Session was set for all requests. The Caché request didn't use any cookies. 
Here we also used  $system.License.PublicWebAppUser() which I think is not available in IRIS

Postman sends the same request as the browser but with a session cookie set automatically. This only consumes one session as in Caché. I want to replicate this behaviour in the browser.

Sending the XMLHttpRequest from the browser, does not include the cookie, and therefore it always uses a new session.
My google search only yielded the answer, that you cannot manually set cookies for XMLHttpRequests because of security reasons.

When doing the requests with the synchronous CSP Broker Method from cspHttpServerMethod, only a single session is used because the session cookie is sent. 
This however also uses XMLHttpRequest and is able to send the request with a session cookie. However I couldn't find how the function did this?

How is the cspHttpServerMethod using the session Cookie and how would I implement it in a request such as this:

 return new Promise((resolve, reject) => {
      let xhttp = new XMLHttpRequest();

      xhttp.open('POST', [URL], true);
      xhttp.setRequestHeader('Content-type', 'text/plain, charset=ISO-8859-1');
      
         var Para=...
      xhttp.send(Para);
      });

Webapp: 

- REST checked
- Dispatch class set 
- GroupByID set
- No authentication checked
- Timeout 900
- Cookie use : Always, Path set, strict, strict

Dispatch class:
-  Parameter HandleCorsRequest = 1; Parameter UseSession As Interger = 1;