removes session api token from user serializer

The session api key is now only provided in the LoggedUserSerializer
which is used for the response of a successful sign in. All other places
that want to serialize a user (post author, editor) will use the
UserSerializer which omits the api key.

Fixes #4