Add uid and verified properties to /session/create responses

Closes #288 and #289

@rfk r?

I added one unfortunate join to authTokens, however it is in line with docs/schema.md for denormalization.