Implement GET /user route

as session getter.

regarding user factory implementation
Thanks for that advice. This does not belong there. I'm going to remove it before merging.