mod: return created user on POST /users
add: session tests