Refactored Users and Level Sessions to have private properties:

This is part of the big upcoming refactoring to have each server handler handle only what it should handle. For example, the level session handler should handle `getLevelSessions` instead of the user handler. 

What did I do? Shifted properties from handlers to corresponding models. I already did the User and LevelSession but the rest are next as soon as this is approved. I did keep `@editableProperties` and the like in the handlers for ease of access, though those are just pointers to the objects owned by the models.

Lots of words right. Why do I care? Users should have private fields that aren't fetched when someone watches their public profile. That's what prompted me to start looking. I already wrote a little method that generates a projection object to pass Mongo, but I haven't decided on where to use it yet.