the GET /session now replies the user object instead of only the user id

When dealing with user setup logic, we need the user accounts on the browser side.

This PR makes the GET /api/session route to reply the entire user object.