Remove PII from /users endpoint URLs

Currently accessing the /users endpoints (and there are probably other similar endpoints) include usernames in the GET requests URLs:

• /followuser.action?username=myname&mode=blank
• /users/viewfollow.action?username=myname
• /users/viewuserprofile.action?username=myname

This allows an attacker to obtain PII from server logs, browser history, etc.

It would be more secure to include the username in the request/response body instead.