Adding Session resources
New features
Scoping API calls around current session token
Respond 403 on unauthorised acces