Fix for cURL request in API not keeping session

This now uses require_once(...) to get the page, instead of making a
complete new request using cURL.

Also some documentation-style fixes.
$_SESSION['salt'] no longer kept

That's insecure, silly.