Reduce dependency on HttpSession in UserSession

Made following changes:
1. Moved SESSION_KEY_USER from `UserService` to `UserREST`
2. Deleted method `public Optional<User> login(String nameOrEmail, String password, HttpSession sessionToFill)` in `UserSession`
3. Modified `UserREST` to populate `HttpSession`