Merge pull request #27 from sarchila/master

checks session token so one can only GET logged in user's info
implement DELETE method for user record
fix bug with logout lookup from session db