the GET /session now replies the user object instead of only the user id