Return masked location mode for managed profiles

If there's a user restriction on location sharing in a
managed profile, always return empty string for location
providers so that location can be disabled by the admin
even if the primary user has location enabled.

Also fix an incorrect update of the cache. Shouldn't update
the primary user's cache when the caller is the managed profile.

Bug: 17478855
Change-Id: Icab3459ae351c5cfc287e21df6a5ba1df9dfbdb4