When logging into the API, don't use the django.contrib.auth login() met...

...hod as that uses state that is stored on the request and could lead to bad things. Just make a new raw session which doesn't use the HTTP request object.
It would be great if we could generalize this session engine stuff into a helper method, because the same logic is used further down in the get() operation -- you can check out PR #291 for an example.