Fields cleanup for User controller

* Only expose `username` in `edit` context.
* Rename `registered` to `registered_date`, and only expose in `view` context.
* Rename `avatar` to `avatar_url`.
* Some test coverage to address potential data leakage.

See #605