Added comments about how user loading works

My understanding is that every time a request is made to the server,
this function is called to get the "current" user. Because of that our
urls can assume that the current user is the one making the request.