state/apiserver/usermanager: fix potential panic

This PR fixes a potential panic in the usermanager which would occur if an api request to change a password arrived authenticated with an entity which was _not_ a `state.User`.

In that circumstance, `getLoggedInUser` would return a `nil`, which was not properly handled by the caller and would result in a panic.

As all callers of the `getLoggedInUser` function were actually after the `state.Entity`'s tag, I changed the method to return the tag.