You need to login before requesting for a session. I thought 'login-form-required=y' is for browser based logins. I login by sending a basic authorization header and request for a site session afterwards and that works for me. Though i haven't tried with ALM 12.
-Pradeep
-Pradeep