Implement "GET /session/id"

Fetches a single session matching the ID, or 404s.