API User sign up and unauthorized responses

Fix #275 

Creates a session serializer to wrap a user object.

Fix #278

When you merge this in, you need to fix both the android and ios clients. heh