User login control flow update

Reverts the bogus session nonsense and requests only a valid "uid"
cookie to perform subsequent operations.  This commit should also
streamline inter-server requests against the API.