tokens: widget-vps-rename.js now should send the user token

Going along with the past two commits... I overlooked ajax requests for securing with tokens, so thanks for pointing them out.

I haven't been able to test this one yet, so you can either leave it there and I'll deal with it at some point, or you can grab it and use it from there. I just wanted to make it available in case you were eager to roll out the tokens.