Handle parameters correctly when logging in

Username and password now are handled correctly. WARNING: This could break if username or password is encoded before passing to api_session.