Fixing signedhttp api

This patch does the following:

* Has a short circuit in APILogin for if a user has already been logged on
* Introduces a cookie_jar for web service calls, so that it has a concept of sessions
 * If a web service call is made while a user is logged in, a user specific cookie jar is used
 * A logged out call has no concept of state.

Notes: 

The default location of the cookie jar is the system temp directory. This is obviously not ideal on shared hosts, however no other directories can be relied on to be present. 

The code does some obfuscation - cookie jar file names are created as a hash of the logged in user's uuid combined with the site secret.