Reorganize /-/user URLs to contain the username

Things to do:

• create a small blueprint for it (!1527 (merged))
• update token and logout views to take the username from a kwarg instead of request.user