You need to make sure that the URL of your shop get initialized as well. You can see how this is done in lib/shopify_login_protection.rb
You need to make the shopify_session method get called before you make any API call. When you use the shopify_app generator, this gets used in the home_controller using a around_filter like this:
around_filter :shopify_session, :except => 'welcome'
The Shopify API uses the ActiveResource library, and this is the conventional way this library gets used. You can learn a bit more about ActiveResource in a screencast here: