Discarded cookie sessions in favor of using http bearer authorization. Works better cross-origin
Always get current user if Authorization header is sent
List and create bookings
Accept, reject and list bookings per user