GET /session to reply the entire user object

When dealing with user setup logic, we need the user accounts on the browser side.

This PR makes the GET /api/session route to reply the entire user object.