Security: Users.update and other routes should have whitelisted parameters to be updated

[BradHN1]

Describe the bug
In testing for security flaws, George Hughey determined that a malicious user could update parameters in the UserProfile model, which in some cases caused a community site not to load. In his particular case he updated a user_type parameter to be a non-valid json string, which when not intermpreted properly caused the canary site not to load. He suggested whitelisting just those parameters that the frontend needs to be able to set.

The same consideration applies to other .update routes for Community, Team, etc.