Fix EZP-20684: Unable to update user object

This PR fixes issue https://jira.ez.no/browse/EZP-20684

The issue was in SPI Content cache not being cleared on updating User data, hence old cached Content being returned on loading User. Clearing SPI User Content is added on ```Cache\UserHandler::update()```.

Additional:

* setting CSRF token intention to Legacy Stack when session based auth is used with REST
* fixing input validation in ```UserService::updateUser()```
* moving reloading of User in ```UserService::updateUser()``` to the top for earlier possible throw
* when ContentInfo cache is cleared also clearing SPI Content cache - Content aggregates ContentInfo but is loaded independently

## TODO

- [x] update [`routing.yml`](https://github.com/ezsystems/ezpublish-community/blob/master/ezpublish/config/routing.yml) in community repo to use configuration for path prefix. See https://github.com/ezsystems/ezpublish-community/pull/48