GET /api/session gets the current session user or 401