API2Client: split out login code