Allow sync manually, instead force sync at ever login

Sync moved to helper, can be called from login and manually from api
maybe we return http.StatusConflict here instead:

```
if user.Syncing {
    w.WriteHeader(http.StatusConflict)
    return
}
```