Add user endpoint and security policy.

Added a UserController that responds to GET and PUT requests at
/user but doesn't allow DELETE or POST request (because you cannot
create or delete users that way).

Added security policies in policies.js.  You can GET anything without
being logged in, but to PUT POST or DELETE you must be logged in.

Accessing /user without being logged in returns null with a 403 code,
whereas /user returns the user object if logged in.