Refactor API into SessionsController and PodsController.

Additionally:
* ensure explicit ACL rules are supplied.
* move enforcing ACL rules into route condition.
* always prolong session if it is specified (also on public GETs).