EventSource and update fixes [master]

- eventsource.php: in case of potential CSRF attack we send an error message from the EventSource to the browser
- eventsource.js: handle undefined data on event
- update.js: in case of error we close the event source - advise the user to reload the page

refs backport of #4014 in order to fix #4005 in master

@karlitschek @icewind1991 @MTGap @butonic @schiesbn THX