[#1729] move most chal-user syncing logic to their models rather than
controllers. don't sync task.value or task.history over to user on
challenge.join()! some work-arounds for the task._id/id mismatch (still
not perfect, need to work on some more)