Add a current user service

A lot of code is getting the current user to get the uid or simple do some user_access().

Let's implement the 'current_user' service from D8
This is the wrong way round and gets the insecure session ID from the secure one.

I would prefer if we did throw a BadMethodCallException for now.

It might be that mixed mode SSL is even removed from core.