Refactor user_pref_api

Changes include:

• Do not call database logic directly for the common use cases. Only
  special cases, like user or project delete, call directly to db
  functions.
• Make account management pages operate explicitly on ALL_PROJECTS. We
  don't support per-project preferences over UI, but if those exists by
  manual creation, at least don't break them.
• Add a way to skip checks for protected users, in some special cases
  core api should be able ti update those too.