578 return temporary session token in user endpoint

closes #578 and #579