Introduce Session object, encapsulating api_url and logged in user.
Mark 'protected' functions map_entity and map_response with _ .
Update the tests.