This can be done trough the API for the current user, or on the
profile page.

Remove password and password_confirmation from whitelisted params in ProfilesController to prevent password from being changed without previous password being provided

Using strong params to require the presence of a username when calling
`update_username`. Otherwise we'd raise a `NoMethodError` validating
the paths on disk.

This reverts commit cb10b725c8929b8b4460f89c9d96c773af39ba6b.

reactivates all tests and writes more tests for it

email token be reset

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>

This reverts commit 01160fc0, reversing
changes made to 4bff9daf.

Previously we were doing all of kinds of code gymnastics and flash abuse
in order to work with a Doorkeeper controller but have it _appear_ at
the `/profile/applications` path. Fortunately we can just tell Rails to
use a different controller to handle that route, and we get the best of
both worlds.

Closes #13855

Safari 9.0 does not yet honor the HTML5 `origin-when-cross-origin` mode,
and it's possible load balancers/proxies strip the HTTP_REFERER from
the request header. In these cases, default to some default path.

Closes #3122

Closes https://github.com/gitlabhq/gitlabhq/issues/9731

It was only used for the appearance live updating, which is now handled
by Profiles::Preferences#update