Hi,
You have to log on through soap action xtk:session#Logon then in subsequent requests pass the session token via http cookie header, e.g. 'Cookie: __sessiontoken=token'.
The logon action also returns a 'pstrSecurityToken' and requests have a field in the soap boilerplate for session tokens but I don't know what those are used for (decoys?).
Thanks,
-Jon