fix: stop request() refusing pre-login REST calls

[diegolmello]

Proposed changes

Api.request gated every call on auth && !this.loggedIn() and threw requires a login locally, so no Endpoint called before a Login ever reached the REST client. auth never controlled the auth headers — setLogin attaches those from the Current login — so the guard was a client-side pre-flight duplicating a decision only the server can make, and could only produce false negatives.

Removes the guard and the auth parameter entirely, from request, the post/get/put/del wrappers, IAPIRequest, and all 15 call sites (including info(), which passed this.loggedIn()). loggedIn() stays public and unchanged.

Closes #385

Steps to reproduce

1. Construct an Api with no Login, so currentLogin is null.
2. Call post on a pre-login Endpoint, e.g. users.forgotPassword.
3. Before: throws requires a login and the REST client is never called. After: the request goes out.

Tests

• sends a request with no login — with currentLogin === null, post('users.forgotPassword', …) reaches the REST client with the Endpoint and payload intact.
• sends info() authenticated once logged in — existing case, still confirms auth headers are attached with a Current login set.