Fix447: Security - Authenticated user is able to change any email

1) Missing to validate that the user being modified matches the authenticate user
2) Deprecated scenario for PutUser in which an anonymous user can modify anonymous user and regenerate sandbox collection. Sandbox is created during migration and this should be enough.

Code Review: http://mrccodereview.cloudapp.net/ui#review:id=1215