All API calls through Octokit

Please have a look at this :wink: 

I reduced the user data that was being stored to the public methods. You think these are enough or is there anything missing? Or would you prefer to not strip anything at all? I could also imagine that the user could configure which attributes they would want to have access to.

I also came across this nasty marshaling bug which would marshal the user's api instance var into the session. I thought that not storing it would be best for now.