_login links fixed when no redirect

`users.template_values()` relied upon `get_current_user()`, which used a request cookie. Because no request cookie is present during a login `get_current_user()` returned no user!

The fix: optional kwarg `user` has been added to `users.template_values()`, if this is specified and not `None`: the object passed as `user` will be used in lieu of `users.get_current_user()` (as `get_current_user()` looks for the request cookie, which isn't supplied in a login request!).