Request's user ivar should be a generic

[tmackenzie]

The Request object's user instance variable type should be a generic.

The Response object's session instance variable should be a generic.

The Response object should have a user instance variable and it should be a generic