Add a page to view active blocks

[AntonKhorev]

This PR adds /account/blocks page that does the following:

• if there are needs_view blocks, redirects to the earliest one of them
• if there are any active blocks, redirects to the earliest one of them
• if there are no active blocks, displays a message that there aren't any blocks, possibly with a link to /user/:username/blocks for reviewing past blocks

The intended use of this page:

• An app that knows or al least suspects that the user is blocked but doesn't want to display the block message itself can give the user a link to this page. Currently the only way to get the website to show the block message is to login, which is not something that a user would do if they are already logged in.

• When you have a needs_view block and try to access the api affected by the block, you get this response:

  You have an urgent message on the OpenStreetMap website. You need to read the message before you will be able to save your edits.

  The problem is, it doesn't tell you how to read the message. We can put a link to /account/blocks and say that the message can be read by visiting this link.

• Maybe we can replace Blocks on Me link in My Profile because it has an active blocks counter.

[tomhughes]

I think this looks fine from a code point of view - my only question is how we use this without effectively turning this URL into API that is baked into clients.

Is you plan that we include this URL in the error the API returns, with the intention that clients will display that error to the user in a way that makes the link clickable?

[AntonKhorev]

I'm thinking if it's important to handle the situation where you're blocked while using a token from one account but logged into osm-website with another account.

• If it is important, sending blocked users to /account/blocks from apps won't quite work because that page wouldn't know about their token account.
• If it's not important then a solution to "how we use this without effectively turning this URL into API" could be making a similar url in the api proper that wouldn't have to rely on auth headers and would redirect to the webpage. Users would be able to open it in a browser and get redirected to /account/blocks.

[tomhughes]

So are you saying this doesn't work as is then? If it's not capable of doing those things? Sounds like we would need it to include the user so we could force a reauthentication if necessary?