LazyLoad user functionality added

* Session data is not accessed until current_user is requested
* The user *must* be accessed though current_user
* Accessing _request_ctx.top.user does not trigger the load, so it should no
  longer be accessed directly