Improve validation for user.website

closes #4444
- validate without protocol in server and client
- when saving the url, add `http://` if the url doesn't have a protocol