Add new decorator to prevent reflected text attacks

Instead of disabling repo names with periods in them, we simply disallow calls to the API when they are GET requests, whose path ends in a dot, and that do not have a referrer from the frontend.

static/js/services/user-service.js

@@ -251,8 +251,5 @@ function(ApiService, CookieService, $rootScope, Config, $location, $timeout) {
   // Update the user in the root scope.
   userService.updateUserIn($rootScope);
 
-  // Load the user the first time.
-  userService.load();
-
   return userService;
 }]);