Assures that instance calls to api have a login associated with them

[fixes #7778194]

For calls on user only if the session is invalid the post operation is called twice after the user is logged in again

Tests fail in master as well because of mocks so skipping:
test/test_user.rb:486
test/test_user.rb:500

Additionally this adds dev dependencies to the gemfile