Fix direct access to settings/user using session.user CP

closes #3162
- removes injection of user object in application route's beforeModel
- adds 'user' property to session object
- updates header nav to reference session.user
- sets model of settings/user route to session.user and forces reload
- on leaving settings/user, rollback any unsaved changes