Users can now send requests prior to messaging

seems dangerous. You could implement to_param on user to return username but that would need to be URL safe.