changed thumbs from base_url to DRUPAL_ROOT.

Since these get copied by image style, use a local path.
Using otherwise will break http auth protected sites.
user check is not case sensitive.