Switch to proper API login endpoint, attempt to capture modhash earlier, properly set cookie on first auth.