update app with new api_call() sig, and make sessions more permanent
wow this is bad
let it be a matter of record how bad this got
switched to oauthlib, improvement a la https://www.youtube.com/watch?v=HFzTm6fy_zs#t=36
just checking, yes, it does work for GET and POST