Show short_name instead of username in the notification

Currently, if your custom user model doesn't use a username field, the notification does not show which account you've hijacked. This change works for both default and custom user models.