Some control API commands are enabled for all back-end servers, no matter whether the control API on the corresponding mapping is enabled or not.
Those unconditional commands are:
SESSION=TERMINATE
SESSION=NEWID
SESSION=NEW
SESSION=CLEAR
REMOVE_CREDENTIALS
REMOVE_HEADERS
SET_SESSION_VARIABLES
ADD_SESSION_VARIABLES
REMOVE_SESSION_VARIABLES