Fix direct access to settings/user using session.user CP

closes #3162
- removes injection of user object in application route's beforeModel
- removes injection/cleanup of user object in signedIn/signedOut actions
- removes loading of user and passing to signedIn action in signup/setup controllers
- adds 'user' property to session object
- updates header nav to reference session.user
- sets model of settings/user route to session.user and forces reload
- on leaving settings/user, rollback any unsaved changes
I think it's been our convention so far to keep this._super() at the top of the function unless there's a specific reason not to (in which case, a comment saying so would be good)