minor adjustments to user management

Use baseURL where possible. Failed to get access to the db via rewrites
like /_users/ by modifying `lib/rewrites.js`, kanso might limit to
accessing the design doc, not sure how to work around that. Was trying
to support future clean URLs with this.

Also changed to underscores for `district_admin` and `kujua_gateway`
which is current.  Voting to consolidate on underscores for roles, see