Have API Client determine auth status more reliably.

[itsjohncs]

The API Client receives permission errors with a special X- header already, so it can detect if the command failed because of permissions. It should follow up such a failure with a call to whoami to determine if the user is actually logged in as who they think they are. If they are not, a warning can be issued, or they can be automatically logged in and out again.