Move routes for clarity

The `user` routes belong to the exercises resource, but they're
authenticated. It got too confusing to have them living somewhere else.