[1.1] Fix user role mass assignment and password editing from backend

This specifically fixes two problems introduced by commit 175a23211337c9ba53242b54d19f84642989e984:
- #2905 Mass assignment exception when creating new users through backend
- #2904 Backend user gets logged into edited user account when changing password

This also reverts the spec changes due to copying code from the frontend user controller.