get session

Added support for GET /_session to get the current user and roles in session.
Goes well the the `.auth` function (POST /_session).

I didn't add any test because I couldn't find a test for the `auth` function, please tell me if this is a problem.

Thanks!