Login flow plus minor updates.

Fixed settings window call.

Demoted login to secondary window and revamped part of the login flow.
Now the api key variable on the api and in the settings are emptied if they are invalid.
why the cast? looks like we can just update app settings constructor to take qobject instead of qwidget