Changing the priority of getUser.

It now prioritizes session information. This helps fix odd browser behavior when
users are making use of frontend code that hits the server with an HTTP
Authorization header sent.