Add api route for login/session_token
Add api route for login/session_token

So that it can support as_user_id.

flag=none
refs LS-2865

Test plan:
* The goal is to load a K5 Subject course as Student View
  using the API
* First, get the user id of a test student in a k5 subject
  - As an admin
  - From any page in a K5 Subject, enter `Student View`
  - As the test student, go to `/api/v1/users/self` in the browser
  - Make note of the user id
* Hit the api/v1/login/session_token endpoint as an admin
  - &as_user_id=<TEST STUDENT USER ID>
  - &return_to=<K5 subject tab URL with ?embed=true>
  - eg /api/v1/login/session_token?embed=true&as_user_id=30&return_to=http://canvas.docker/courses/5?embed=true%23modules
* Load the returned session_url into an incognito window
* The k5 subject tab should as the test student
  * note, because of the embed=true param, the purple
    student view chrome won't be displayed
  * you can tell if you're getting the student view on
    #modules if there are not options to add or edit modules

Change-Id: I700aa906f7998cfe5fb671cbe67e909eea9731c2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/279514
Reviewed-by: Eric Saupe <e7287cf05ae62bc45889f17a9d34b8fae8d5afd1@instructure.com>
QA-Review: Eric Saupe <e7287cf05ae62bc45889f17a9d34b8fae8d5afd1@instructure.com>
Product-Review: Nate Armstrong <619b324efbf5f7848de055bdc8bef4c0dd7c8ef5@instructure.com>
Tested-by: Service Cloud Jenkins <9144042a601061f88f1e1d7a1753ea3e2972119d@instructure.com>

instructure/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms,sfu/canvas-lms,instructure/canvas-lms,sfu/canvas-lms