fix issues with API calls as they stand

Fixed:
* SSO calls return 302, not 200
* Excon doesnt decode URL components for basic auth
* search returns results in a 'users' hash

Still broken:
* The current PUT call to update the user's email has no effect