Only verify login state at the beginning of the request.

This should fix the bug related to sending too many cookies.

PLEASE TEST. Although I have tried most cases (logging in/out, generating a token that's broken, setting the session timeout at timestamp 0), I'd rather be sure nothing is broken. Nothing should be though.

This is also Shaarli's first mobile PR, sent from a car :beer: