ReUse Flask's url_for functionality where possible

* _scheme introduced in 0.10 instead of _secure (to be deprecated)
* remove url args building through params
Add more classes to API documentation
Flake8ify
Handle invalid sessions #2220