User profile settings form

* Add User model form
* Add `settings.html` template using the form
* Add `privacy_controls.html` partial (which will also be used in popup from profile page)
* Add views
* Strip whitespace from first/last name in `User.clean`

In a future PR:
* Add Bootstrap so tab panels will work
* Add JS to enable/disable privacy controls and set hidden fields
Yes but where does it come from? When `render_template` is called via the URL handler, `request` is passed along there. But when `render_template` is called from a view function there's no way to pass `request`. It's not just floating around in the air.