Don't store gh username or avatar URL in our db.

We'll keep those in the session cookie instead. A small perf hit (meaning every
time you logout--which purges the cookie--then login we need to ask the GitHub API
who you are, rather than just asking our own database). But an overall win in terms
of storing less personally identifiable data than we need to.