Agreed. Except, I'd argue that the "API" could be seen as the browser itself - the "universal" API that everyone is familiar with and that offers endless possibilities. Today, browsers offer largely the same user experience irrespective of OS or browser (of course, this isn't true if the browser is a sandboxed/broken browser that forces web developers back into the dark ages of huge differences between user experiences depending on browser selection).
The API could add another 'layer' for announcing limitations, walled garden resources, and other information, but my opinion is that if the information didn't come from the *network*, why would you want to believe it? In public access, there WILL be incentives to give misleading information from an API. If you trust, you must still verify.
As for as API for login, as I previously mentioned, that already exists and widely deployed and used. Replacing WISPr is a GOOD idea, but I question whether there will be motivation to actually deploy it (unless we make a mistake and it is useful for additional commercial trickery in public access).
Thanks for reading my ICMP I-D ... comments are welcome! Yes, it could use more attention and improvements... I encourage others to (re-)read it.