Use instance variables for credentials

Store login and password in instance variables for being available for re-authentication
Remove merge of 'params' and 'headers'

This merge is removed for two reasons:
1. `post` doesn't merge them either
2. when re-authentication is required, the old token cookie in
`headers[:cookie]` would overwrite the newly fetched cookie as `headers`
would be handled as if it were passed to `get` after `retry`
Improve response status handling
Merge pull request #1 from mwulftange/retry-on-forbidden

Fix retry-on-forbidden