Describe `access_token` param of `User.logout`

Add an explicit note that clients are not supposed to send the
`access_token` parameter, since it is extracted from request
headers.
Add `include=user` param to `User.login`

Allow LB clients to get details of the currently logged-in user
as part of the login response.

Improve method's `description` to mention this new option.