In the case of a login attempt, resp.Body is explicitly closed.
Shouldn't it be closed in all cases?
Need to audit calls to newTalkToApstraErr()... Ensure that resp.Body is never closed by callers and then ensure that newTalkToApstraErr() always closes it.
In addition... Ensure that all paths out of newTalkToApstraErr() return an io.NopCloser as resp.Body, so that what happens downstream is irrelevant.