slightly refactor Api class

now uses the current user for credentials, except if they are passed in explicitly, which is only necessary for login
the URL is now assembled by using the URI class, which properly escapes the necessary portions.
once we switch to messageformat based rest resource description, we can get rid of most explicit string operations on urls