Its a two pass process.. the 1st pass gets the session cookie (and the Auth required)
the second pass USES the cookie..

here is a little curl script (windows)

set COOKIES=.\cookies.txt

set USER=uuuu
set PASSWORD=ppppp
set HOST=https://localhost:9446

rem get the session cookie
curl -k -c %cookies% "%host%/jts/authenticated/identity" >nul

rem use the session cookie to logon
curl -k -L -b %COOKIES% -c %COOKIES% -d j_username=%USER% -d j_password=%PASSWORD% %host%/jts/authenticated/j_security_check >nul

rem use the cookie to get the catalog
curl -k -L -b %COOKIES% -H "Accept: application/xml" %host%/ccm/oslc/workitems/catalog

curl -k -L -b %COOKIES% -H "Accept: application/xml" %host%/ccm/oslc/contexts/_GYeCsFT4EeKDJbr7x3deog/workitems/services.xml

curl -k -L -b %COOKIES% -H "Accept: application/xml" %host%/ccm/oslc/contexts/_GYeCsFT4EeKDJbr7x3deog/workitems

set o="curl -k -L -b %COOKIES% %host%/ccm/rpt/repository/workitem?fields=workitem/workItem/itemHistory\[modifiedBy/name='sam'\]/(stateId|predecessor|state/name|modified|modifiedBy/name|modified)"
echo %o%