Rewrote duplicate-field-value checks

When creating a new user, the duplicate checks are now more appropriate
than the previous code, which abused makeSlug() to "canonicalize"
values; this caused false positives ('foo-' was considered equal to
'foo') as well as false negatives.

The new checks should work better: for e-mail, only case and surrounding
whitespace is normalized; for usernames, only alphanumeric, dash, and
underscore are kept for the comparison, and case is normalized.

Fixes #697
Merge remote-tracking branch 'upstream/master'