[0.2.0] Adjust to new API behaviours

Fixes:

• Set CSRF token early (before API calls) and refresh it at each request
• Use explicit application/json Accept, otherwise Lychee rejects the request

Known problems:

• Error checking is really bad at our side (we should check HTTP codes)
• No testing