tokens: widget-vps-rename.js now should send the user token with its rename POST request, so renames can't be spoofed by outsiders.