Add a resource for retrieving info on the client's session.

This introduces a new /api/session/ resource, which returns some very
basic information on the client's session.

If the client is logged in, the 'authenticated' key will be set to True, and a
link to the logged in user will be returned.

If the client is not logged in, the 'authenticated' key will be set to False.

In the future, we may want to provide more information in this (such as API
rate limiting), but this is useful for now.

Added test cases. They passed. Also verified that the information is correct when logged in and out.

Since we handle expanded resources ourselves here, I also tested to make sure that ?expand=user works for this resource.