Public and Admin user controlller

Moved over user related functions from the public bundle to the user
bundle, and split the controller into public and admin controllers.
Fixed bug where anyone could try to access /user/change because the url
was wrong in the config.