Return user objectwith self.current_user

This cleans up the codebase by returning a user object for self.current_user instead of just the email. Almost every instance of the call was just instantiating a user object anyway, so this makes that boilerplate. It also allows the base template to automatically get user info and level for rendering.
This is the concern: potential unexpected consequences of returning a `User` instead of a `str` for Tornado