thanks @RicardoDe - this is an interesting finding. Creating parallels with how client-side implementation works, I believed having session-id is mandatory for Delivery-APIs, will try omitting it to understand the behaviour in more detail.
For the second part where you see expected behaviour while...