I'm not sure the current taxonomy should even be set when using the API, as there's no notion of context supported there already.  My main concern though is that authenticating against the API shouldn't modify the session.

If you're accessing the API as a session user, I don't see that you'll hit this code, as you'd take the fast return out of #authenticate.  This code I think is only run during authentication (e.g. basic auth).

I think this line should move into the block below (`unless api_request?`), next to `session[:user]`.  Does that seem correct?