user and session separated; session stores the token, user has an id

Signed-off-by: Mikolaj Szabo <savingprivateblue@gmail.com>