Split out an HTTPRequestBuilder interface.
Fix a typo.
Move as much API HTTP code as possible into its own package.
CheckResponse -> ExtractAPIError.
Limit TLS scope via the server name.