Refactor Session#api_call and Session#refresh_access_token, add some specs
Remove unused code
Handle non-hash responses for api calls
Remove session-only functionality (using session_key) for now; only OAuth2 supported
Support quirky json (not dictionary or arrays in the root)