display login failure/logout success within the header itself

* Fixes #146
* fix a previous-masked bug in which api_core.logout() was failing: the error was
```
PHP Notice:  A session had already been started - ignoring session_start() in /var/www/api/api_core.php on line 75
```
and was being masked by the fact that the login/logout fail() option was a noop.