Improve validation for user.website

closes #4444
- validate URL without protocol in server and client
- when saving url, add `http://` if the url doesn't have a protocol