Fix validations on user settings page

Closes #3271
- Change validations on both server and client to allow the
  Website field to be empty or a valid URL.
- Add new schema validation helper isEmptyOrURL.
- Remove duplicate call to UserValidator in the save action
  of the SettingsUser controller.
- User.last_login and User.created_at are already Moment objects
  so Moment#fromNow can be called on them directly.
Merge pull request #3272 from jaswilli/issue-3271

Fix validations on user settings page
Server side cleanup

- remove sessions
- remove all references to csrf
- create a shared base model for the 2 types of token