destroying session should be a DELETE request
updating email
User Agent Parser
renaming token to access_token, adding user_id to json responses