This is going to expose the user session and model directly, skipping the API.

Having a session isn't quite the same as having an oauth token which is authorized.. its quite possible to have one but not the other. We should really use an api call to /api/v2/users/me to check the authorized user attached to our oauth token instead. I guess this is where the blurred line between API and UI makes this confusing.