Clean up handling of fingerprints.

This makes the handling more similar to meatspace v1, which is:
- Clients don't calculate a user ID or care about their IP.
- The server calculates a user ID with a fingerprint+IP hash. When a
  message is posted from a client, the server calls the client back to
  tell them what their user ID was.
- Clients track some amount of their previous user ID's and use this for
  e.g. hiding the mute button on their own messages.

Somewhat unrelatedly, this change also adds a size limit check before
doing a JSON.parse on socket messages, cause like, parsing arbitrarily
sized JSON is real bad. Especially since we'd just throw the data on the
ground 2 calls down the chain.