private function call($method, $url, $csrf = false, $data = false) {

        $ch = curl_init();
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $method);
        curl_setopt($ch, CURLOPT_URL, $url);
        $headers = array();

        if ($data) {
            curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
            $headers[] = 'Content-Type: application/json';
            $headers[] = 'Content-Length: ' . strlen($data);
        }
        if ($csrf) {
            $headers[] = 'X-XSRF-TOKEN: ' . $csrf;
        }

        curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

        curl_setopt($ch, CURLOPT_COOKIEJAR, $this->cookiejar);
        curl_setopt($ch, CURLOPT_COOKIEFILE, $this->cookiejar);

        return curl_exec($ch);
    }

    private function csrf(){
        return json_decode($this->call('POST', $this->api_url, false, "username={$this->api_username}&password={$this->api_password}"));
    }

    function get($url) {
        $response = $this->call('GET', $this->api_url . $url, $this->csrf());
        return json_decode($response, true); //assoc array
//        return $response; //json
    }