It supports cookie auth for the browse-able web interface it makes available for APIs. It's optional though and it also supports HTTP auth and other auth styles as well I think.