refactor authentication code and Api class

disentangled currentUser method and request authentication
clean up some internals of the (soon to be deprecated) Api class