Add /api/whoami

When you finish OAuth authentication, it can be nice to figure out who
you've just authenticated as. This method redirects to the
authenticated user's profile.
Allow posting to the inbox with host credentials
Errant comma
More forgiving if object has no likes or shares