This can be done trough the API for the current user, or on the
profile page.

Remove password and password_confirmation from whitelisted params in ProfilesController to prevent password from being changed without previous password being provided

Direct disk access is done through Gitaly now, so the legacy path was
deprecated. This path was used in Gitlab::Shell however. This required
the refactoring in this commit.

Added is the removal of direct path access on the project model, as that
lookup wasn't needed anymore is most cases.

Closes https://gitlab.com/gitlab-org/gitaly/issues/1111

Using strong params to require the presence of a username when calling
`update_username`. Otherwise we'd raise a `NoMethodError` validating
the paths on disk.

Security fixes for 10.1 RC

See merge request gitlab/gitlabhq!2209

and rubocop fixes

a reconfirmation