This is by design, the CMIS endpoint is not designated as stateful so does not generate a (needless) HTTP session which does not create a JSESSIONID cookie.
Edit: it's possible to make an endpoint use a stateful HTTP session and therefore a cookie through some config. To do that, the <authenticationPlugin> of the authenticators extension point defining the authentication for the given URL pattern must include <stateful>true</stateful>. This is done for instance here. Compare this with the standard binding for the browser binding endpoint here.
