Fix session security problem while login

This patch adds the session config in user's config file. And validate
the request against the session config.

## Question

How to handle the error when the type is not match? You can see how I do it in line 125 of user-collection.js. But I don't think it is right.