Move login logic to session object; fixed a bug with logging in again in ApiRequest