First pass at user edit form validation.

Currently only validates a few things, but better than nothing.  Also,
while I was at it, govern access to the user edit routes through a
single middleware.