optimize touch_all_products performance

use sql update instead of touch each products.

Fixes #4910
Permit first_name and last_name in address attributes

These parameters are aliases for firstname and lastname, and so should be permitted through as well.

This used to work in 2-2-stable, but was broken as of 2-3-stable.