Improving API

POST params are now in the BODY so they are encrypted with the SSL
connection. Changing password strategy with a nonce to prevent replay
attacks as well.