update API to handle CSRF token

Hi Sam, 

since a few API calls were not working I updated them. The main improvement is that now it's possible to request the CSRF token, set the session and use them for protected requests. 

Andrea