public.json: Add 'GET /session' for easier login checks

In azurestandard/website@aecdf79a (app/scripts/controllers.js: Hit
/person to get a session cookie, 2014-12-02), I started logging in via
basic auth and the /person endpoint.  However, it's possible that the
user *already* has a cookie from a previous session when they
initially load the Angular app.  It's hard to check one way or the
other because you need withCredentials to pass the possible cookie,
but if withCredentials is set and you don't have the cookie, the
/person endpoint returns the 401 with WWW-Authenticate suggesting
basic auth and Firefox pops up its usual basic auth dialog (ugly).  By
adding the /session endpoint, which *only* accepts session cookies
(and not basic auth), we gain an endpoint that we can hit with
withCredentials without popping up the basic auth dialog on failure.

The returned data has two purposes: you can check session.person to
see if you're running an anonymous session (you aren't if
session.person is a number), and you can check session.expires to
figure out how long your session will last [1].  The expiration date
is just the server's commitment, the user agent may evict the cookie
at any time [1].  For details on the browser-close comment, see the
persistent-flag description in RFC 6265 section 5.3 [1].

[1]: http://tools.ietf.org/html/rfc6265#section-5.3