Notification boxes don't handle users without fullnames.

The notification box that appears when a review request has been updated
names the user that made the latest change. We weren't handling the case
where that user doesn't have a fullname, and we'd display the empty string
for their name. Now, if we don't have the fullname, we display the username
instead.