safer check for user get_absolute_url

in case a profile doesn't exist yet
patch jquery ajax with csrf token header,refs #791
Merge branch 'master' of github.com:MapStory/mapstory
bind doSearch to map pan/zoom, refs #666 - muhaha