added /session/status endpoint

This adds an endpoint to check whether a sessionToken is still valid.

r?

fixes #610