Add a configurable whitelist of public user props

By default no user properties are public and attempts to view a users
document other than your own will return a 404. If the public_fields
setting of the users_db config section is set to a list of field
names, however, you will see that subset of fields for any user.

Contributed with code parts from @indutny