more readme
refactor xhr session management
authenticated non-rest requests
make sure auth flow actually works