Did some work on update_user.php

Combined update_user and update_user_enabled, implemented CSRF
protection for updating user enabled status