return user upon creation

Necessary because the client must know the user's id.
get user info from session id

This allows the api to be more friendly by requiring clients to
only remember one piece of information: the session id cookie.