Use the URL's user, not the session's user

- Since now we can edit other user's information, need to use the URL's
  username, not the sessions username.
- New helper function, auth.get_user_id(username, db), to get a user's ID