move javascript variables 'oc_current_user' and 'oc_requesttoken' to js.js - fixes #3853