Implement GET /user route

as session getter.

regarding user factory implementation
There's not that big of a difference, but we should use Flight's json function in the future.