We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
'On my own' device - Merging a user is not working
## Observed behavior
Observed while integration testing the [v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1) release.
When I try to merge a user created through 'On my own' I am getting an "Invalid URL" error in the console. Note that creating a new account through the same flow is working correctly. This issue is caused by the changes made in https://github.com/learningequality/kolibri/pull/12028 and is not extant in [v0.16.1-beta0](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta0).

https://github.com/learningequality/kolibri/assets/79847249/30daa3ca-918c-4c15-901b-c74c08b96466

## Expected behavior

Fully functional 'Merge accounts' user flow. 

## Steps to reproduce the issue

1. Install [v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1).
2. Setup a full device as a server and another device by going through the 'On my own' setup flow.
3. Attempt to merge the user from the 'On my own' device' to the server facility.

## Logs

[logs.zip](https://github.com/learningequality/kolibri/files/14850735/logs.zip)

## Usage Details
[v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1)
Windows 11, Ubuntu 22  - Chrome

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `kolibri/plugins/user_profile/viewsets.py`
Content:
```
1 import requests
2 from django.contrib.auth import login
3 from django.core.exceptions import ValidationError as DjangoValidationError
4 from rest_framework.exceptions import ValidationError
5 from rest_framework.response import Response
6 from rest_framework.views import APIView
7 
8 from .utils import TokenGenerator
9 from kolibri.core.auth.models import FacilityUser
10 from kolibri.core.utils.urls import reverse_remote
11 from kolibri.utils.urls import validator
12 
13 
14 class OnMyOwnSetupViewset(APIView):
15     """
16     Viewset to determine if the facility has been setup as an "On my own setup" facility.
17     """
18 
19     def get(self, request, format=None):
20         if request.user.is_anonymous:
21             self.permission_denied(request)
22         user_facility = self.request.user.facility
23         return Response(
24             {
25                 "on_my_own_setup": user_facility.on_my_own_setup,
26             }
27         )
28 
29 
30 class RemoteFacilityUserViewset(APIView):
31     def get(self, request):
32         baseurl = request.query_params.get("baseurl", "")
33         try:
34             validator(baseurl)
35         except DjangoValidationError as e:
36             raise ValidationError(detail=str(e))
37         username = request.query_params.get("username", None)
38         facility = request.query_params.get("facility", None)
39         if username is None or facility is None:
40             raise ValidationError(detail="Both username and facility are required")
41         url = reverse_remote(baseurl, "kolibri:core:publicsearchuser-list")
42         try:
43             response = requests.get(
44                 url, params={"facility": facility, "search": username}
45             )
46             if response.status_code == 200:
47                 return Response(response.json())
48             else:
49                 return Response({})
50         except Exception as e:
51             raise ValidationError(detail=str(e))
52 
53 
54 class RemoteFacilityUserAuthenticatedViewset(APIView):
55     def post(self, request, *args, **kwargs):
56         baseurl = request.query_params.get("baseurl", "")
57         try:
58             validator(baseurl)
59         except DjangoValidationError as e:
60             raise ValidationError(detail=str(e))
61         username = request.data.get("username", None)
62         facility = request.data.get("facility", None)
63         password = request.data.get("password", None)
64         if username is None or facility is None:
65             raise ValidationError(detail="Both username and facility are required")
66         url = reverse_remote(baseurl, "kolibri:core:publicuser-list")
67         params = {"facility": facility, "search": username}
68 
69         # adding facility so auth works when learners can login without password:
70         username = "username={}&facility={}".format(username, facility)
71 
72         auth = requests.auth.HTTPBasicAuth(username, password)
73         try:
74             response = requests.get(url, params=params, verify=False, auth=auth)
75             if response.status_code == 200:
76                 return Response(response.json())
77             else:
78                 return Response({"error": response.json()["detail"]})
79         except Exception as e:
80             raise ValidationError(detail=str(e))
81 
82 
83 class LoginMergedUserViewset(APIView):
84     """
85     Viewset to login into kolibri using the merged user,
86     after the old user has been deleted
87     """
88 
89     def post(self, request):
90         pk = request.data.get("pk", None)
91         token = request.data.get("token", None)
92         new_user = FacilityUser.objects.get(pk=pk)
93         if not TokenGenerator().check_token(new_user, token):
94             return Response({"error": "Unauthorized"}, status=401)
95         login(request, new_user)
96         return Response({"success": True})
97
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/kolibri/plugins/user_profile/viewsets.py b/kolibri/plugins/user_profile/viewsets.py
--- a/kolibri/plugins/user_profile/viewsets.py
+++ b/kolibri/plugins/user_profile/viewsets.py
@@ -53,7 +53,7 @@
 
 class RemoteFacilityUserAuthenticatedViewset(APIView):
     def post(self, request, *args, **kwargs):
-        baseurl = request.query_params.get("baseurl", "")
+        baseurl = request.data.get("baseurl", "")
         try:
             validator(baseurl)
         except DjangoValidationError as e:

{"golden_diff": "diff --git a/kolibri/plugins/user_profile/viewsets.py b/kolibri/plugins/user_profile/viewsets.py\n--- a/kolibri/plugins/user_profile/viewsets.py\n+++ b/kolibri/plugins/user_profile/viewsets.py\n@@ -53,7 +53,7 @@\n \n class RemoteFacilityUserAuthenticatedViewset(APIView):\n     def post(self, request, *args, **kwargs):\n-        baseurl = request.query_params.get(\"baseurl\", \"\")\n+        baseurl = request.data.get(\"baseurl\", \"\")\n         try:\n             validator(baseurl)\n         except DjangoValidationError as e:\n", "issue": "'On my own' device - Merging a user is not working\n## Observed behavior\r\nObserved while integration testing the [v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1) release.\r\nWhen I try to merge a user created through 'On my own' I am getting an \"Invalid URL\" error in the console. Note that creating a new account through the same flow is working correctly. This issue is caused by the changes made in https://github.com/learningequality/kolibri/pull/12028 and is not extant in [v0.16.1-beta0](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta0).\r\n\r\nhttps://github.com/learningequality/kolibri/assets/79847249/30daa3ca-918c-4c15-901b-c74c08b96466\r\n\r\n## Expected behavior\r\n\r\nFully functional 'Merge accounts' user flow. \r\n\r\n## Steps to reproduce the issue\r\n\r\n1. Install [v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1).\r\n2. Setup a full device as a server and another device by going through the 'On my own' setup flow.\r\n3. Attempt to merge the user from the 'On my own' device' to the server facility.\r\n\r\n## Logs\r\n\r\n[logs.zip](https://github.com/learningequality/kolibri/files/14850735/logs.zip)\r\n\r\n## Usage Details\r\n[v0.16.1-beta1 ](https://github.com/learningequality/kolibri/releases/tag/v0.16.1-beta1)\r\nWindows 11, Ubuntu 22  - Chrome\n", "before_files": [{"content": "import requests\nfrom django.contrib.auth import login\nfrom django.core.exceptions import ValidationError as DjangoValidationError\nfrom rest_framework.exceptions import ValidationError\nfrom rest_framework.response import Response\nfrom rest_framework.views import APIView\n\nfrom .utils import TokenGenerator\nfrom kolibri.core.auth.models import FacilityUser\nfrom kolibri.core.utils.urls import reverse_remote\nfrom kolibri.utils.urls import validator\n\n\nclass OnMyOwnSetupViewset(APIView):\n    \"\"\"\n    Viewset to determine if the facility has been setup as an \"On my own setup\" facility.\n    \"\"\"\n\n    def get(self, request, format=None):\n        if request.user.is_anonymous:\n            self.permission_denied(request)\n        user_facility = self.request.user.facility\n        return Response(\n            {\n                \"on_my_own_setup\": user_facility.on_my_own_setup,\n            }\n        )\n\n\nclass RemoteFacilityUserViewset(APIView):\n    def get(self, request):\n        baseurl = request.query_params.get(\"baseurl\", \"\")\n        try:\n            validator(baseurl)\n        except DjangoValidationError as e:\n            raise ValidationError(detail=str(e))\n        username = request.query_params.get(\"username\", None)\n        facility = request.query_params.get(\"facility\", None)\n        if username is None or facility is None:\n            raise ValidationError(detail=\"Both username and facility are required\")\n        url = reverse_remote(baseurl, \"kolibri:core:publicsearchuser-list\")\n        try:\n            response = requests.get(\n                url, params={\"facility\": facility, \"search\": username}\n            )\n            if response.status_code == 200:\n                return Response(response.json())\n            else:\n                return Response({})\n        except Exception as e:\n            raise ValidationError(detail=str(e))\n\n\nclass RemoteFacilityUserAuthenticatedViewset(APIView):\n    def post(self, request, *args, **kwargs):\n        baseurl = request.query_params.get(\"baseurl\", \"\")\n        try:\n            validator(baseurl)\n        except DjangoValidationError as e:\n            raise ValidationError(detail=str(e))\n        username = request.data.get(\"username\", None)\n        facility = request.data.get(\"facility\", None)\n        password = request.data.get(\"password\", None)\n        if username is None or facility is None:\n            raise ValidationError(detail=\"Both username and facility are required\")\n        url = reverse_remote(baseurl, \"kolibri:core:publicuser-list\")\n        params = {\"facility\": facility, \"search\": username}\n\n        # adding facility so auth works when learners can login without password:\n        username = \"username={}&facility={}\".format(username, facility)\n\n        auth = requests.auth.HTTPBasicAuth(username, password)\n        try:\n            response = requests.get(url, params=params, verify=False, auth=auth)\n            if response.status_code == 200:\n                return Response(response.json())\n            else:\n                return Response({\"error\": response.json()[\"detail\"]})\n        except Exception as e:\n            raise ValidationError(detail=str(e))\n\n\nclass LoginMergedUserViewset(APIView):\n    \"\"\"\n    Viewset to login into kolibri using the merged user,\n    after the old user has been deleted\n    \"\"\"\n\n    def post(self, request):\n        pk = request.data.get(\"pk\", None)\n        token = request.data.get(\"token\", None)\n        new_user = FacilityUser.objects.get(pk=pk)\n        if not TokenGenerator().check_token(new_user, token):\n            return Response({\"error\": \"Unauthorized\"}, status=401)\n        login(request, new_user)\n        return Response({\"success\": True})\n", "path": "kolibri/plugins/user_profile/viewsets.py"}], "after_files": [{"content": "import requests\nfrom django.contrib.auth import login\nfrom django.core.exceptions import ValidationError as DjangoValidationError\nfrom rest_framework.exceptions import ValidationError\nfrom rest_framework.response import Response\nfrom rest_framework.views import APIView\n\nfrom .utils import TokenGenerator\nfrom kolibri.core.auth.models import FacilityUser\nfrom kolibri.core.utils.urls import reverse_remote\nfrom kolibri.utils.urls import validator\n\n\nclass OnMyOwnSetupViewset(APIView):\n    \"\"\"\n    Viewset to determine if the facility has been setup as an \"On my own setup\" facility.\n    \"\"\"\n\n    def get(self, request, format=None):\n        if request.user.is_anonymous:\n            self.permission_denied(request)\n        user_facility = self.request.user.facility\n        return Response(\n            {\n                \"on_my_own_setup\": user_facility.on_my_own_setup,\n            }\n        )\n\n\nclass RemoteFacilityUserViewset(APIView):\n    def get(self, request):\n        baseurl = request.query_params.get(\"baseurl\", \"\")\n        try:\n            validator(baseurl)\n        except DjangoValidationError as e:\n            raise ValidationError(detail=str(e))\n        username = request.query_params.get(\"username\", None)\n        facility = request.query_params.get(\"facility\", None)\n        if username is None or facility is None:\n            raise ValidationError(detail=\"Both username and facility are required\")\n        url = reverse_remote(baseurl, \"kolibri:core:publicsearchuser-list\")\n        try:\n            response = requests.get(\n                url, params={\"facility\": facility, \"search\": username}\n            )\n            if response.status_code == 200:\n                return Response(response.json())\n            else:\n                return Response({})\n        except Exception as e:\n            raise ValidationError(detail=str(e))\n\n\nclass RemoteFacilityUserAuthenticatedViewset(APIView):\n    def post(self, request, *args, **kwargs):\n        baseurl = request.data.get(\"baseurl\", \"\")\n        try:\n            validator(baseurl)\n        except DjangoValidationError as e:\n            raise ValidationError(detail=str(e))\n        username = request.data.get(\"username\", None)\n        facility = request.data.get(\"facility\", None)\n        password = request.data.get(\"password\", None)\n        if username is None or facility is None:\n            raise ValidationError(detail=\"Both username and facility are required\")\n        url = reverse_remote(baseurl, \"kolibri:core:publicuser-list\")\n        params = {\"facility\": facility, \"search\": username}\n\n        # adding facility so auth works when learners can login without password:\n        username = \"username={}&facility={}\".format(username, facility)\n\n        auth = requests.auth.HTTPBasicAuth(username, password)\n        try:\n            response = requests.get(url, params=params, verify=False, auth=auth)\n            if response.status_code == 200:\n                return Response(response.json())\n            else:\n                return Response({\"error\": response.json()[\"detail\"]})\n        except Exception as e:\n            raise ValidationError(detail=str(e))\n\n\nclass LoginMergedUserViewset(APIView):\n    \"\"\"\n    Viewset to login into kolibri using the merged user,\n    after the old user has been deleted\n    \"\"\"\n\n    def post(self, request):\n        pk = request.data.get(\"pk\", None)\n        token = request.data.get(\"token\", None)\n        new_user = FacilityUser.objects.get(pk=pk)\n        if not TokenGenerator().check_token(new_user, token):\n            return Response({\"error\": \"Unauthorized\"}, status=401)\n        login(request, new_user)\n        return Response({\"success\": True})\n", "path": "kolibri/plugins/user_profile/viewsets.py"}]}