578 return temporary session token in user endpoint

closes #578 and #579
I wouldn't consider this an exceptional circumstance, let's not raise an exception but just return an error status and message to the user