removes all _session code from User

this was all based on a misunderstanding of the system.

The only time a new User is created is when a new websocket User is
created, which is when there is no sessionId.  So to try and get stuff
out of an existing session on startup is pointless.

The User will be around for at least as long as the websocket User, so
if we're keeping session data in memory then the best place to keep it
is just on the User.
adds isInProgress() to Game
adds replaced User to spectators in Game - the user still has it in their
_currentGames so otherwise they will see a game with nothing happening if
they go back to their replaced session.