sessions#show

closes #12

`GET /api/session` (with Access-Token header) returns
```json
{
    "token": "4ebbcf209ca3625dfe0b2595d627ffacd90f8cefd69722712a451a7c291643af",
    "admin": true
}
```