Protects PATCH /user_preferences endpoint

- requires notification_preferences.write scope
- refactors authenticator middleware to take scopes as an argument

[#76994742]