checks session token so one can only GET logged in user's info