Adding the user api controller.  Also allows the api consumer to just use the session cookie id to validate login instead of having to include a key.