add whoami to api routes
put user info in a hash for clients to consume