Read a session and the user it belongs to together.

Authenticating needs both, and the user id is only known once the session has been read, so as two reads they can never overlap — on a cold edge server that is two waits before the page can start. A session whose user has since been deleted still comes back, so the caller can tell that apart from an unknown token and clear the stale row.

The user's admin level decides what the viewer may do, so it is read afresh every time and never served from the session cache.