Do you say that you can not allow 'regular' registered users to access 'offline' joomla website?

Is there a specific reason for it? I mean nobody will see the difference.

You've found your workaround, however note that API should be stateless, and should not involve sessions.

I've edited the answer and added a few additional lines, in the end, you'll see those after moderation goes through. Overall this would work as it is with jQuery, with something more advanced - you'll need those lines in PHP.