Fix #1424 by cleaning up ownership transfer process

Fixes #1424 

* Admins are no longer "special", they can confirm ownership as any other user could
* If your logged-in user name != user name in URL, we should a descriptive message. Because we do NOT check if the request actually exists, this doesn't leak info (i.e. try changing the user name in the URL and it will always show the message, regardless of if there is a request for that user).