session api

To be able to remotely login and establish a session I need a JSON interface instead of the `/login` HTML one.

This PR introduces 2 new endpoints:

* PUT /api/session - to create a session based on user credentials.
* GET /api/session - gets current session user, if one exists.