CRM-15247 - CRM_Contact_Page_AJAX::checkUserName - Require a token before checking...

CRM-15247 - CRM_Contact_Page_AJAX::checkUserName - Require a token before checking username

The use-case for this function: when a new constituent signs up for a user
account, we give advice on whether the username is available.

Unfortunately, attackers can use that functionality to scan the list of
usernames.  There's no protection from a motivated attacker (except to
disable new signups).

This patch aims to mitigate the problem in two ways:
 - For sites which don't allow user signups, the scanning won't work (b/c
   attackers can't obtain a token).
 - For sites which do allow signups, scanning requires more work
   (to obtain & refresh tokens).