update_comfyui crashes on legacy UI after CSRF gate (regression in 4.2.1, #2819)

### Custom Node Testing

- [x] I have tried disabling custom nodes and the issue persists (see [how to disable custom nodes](https://docs.comfy.org/troubleshooting/custom-node-issues#step-1%3A-test-with-all-custom-nodes-disabled) if you need help)

### Expected Behavior

Clicking "Update ComfyUI" in the legacy Manager UI queues a ComfyUI update and returns HTTP 200, same as it did in 4.2.0 and earlier. No exception in the server log.

### Actual Behavior

Clicking "Update ComfyUI" in the legacy Manager UI does nothing visible in the browser, and the server logs an unhandled AttributeError: 'NoneType' object has no attribute 'content_type' from comfyui_manager/common/manager_security.py:65. The update is never queued. A 500 response is returned to the client.

### Steps to Reproduce

1. Install ComfyUI with `comfyui-manager==4.2.1` (current PyPI release; pulled in by `manager_requirements.txt`).
2. Start ComfyUI with both flags: `python main.py --enable-manager --enable-manager-legacy-ui`.
3. Open the web UI in a browser and switch to / open the legacy Manager menu.
4. Click the **Update ComfyUI** button.
5. Observe: the button does nothing in the UI, and the server logs the `AttributeError: 'NoneType' object has no attribute 'content_type'` traceback shown in the Actual Behavior section.

No workflow JSON is needed — the bug is in the manager's HTTP handler, not in graph execution. It reproduces on a fresh ComfyUI install with no custom nodes loaded.

### Debug Logs

```powershell
[START] Security scan
[ComfyUI-Manager] Using uv as Python module for pip operations.
[DONE] Security scan
** ComfyUI startup time: 2026-04-27 10:01:38.118
** Platform: Linux
** Python version: 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0]
** Python executable: /usr/bin/python3
** ComfyUI Path: /app/ComfyUI
** ComfyUI Base Folder Path: /app/ComfyUI
** User directory: /app/ComfyUI/user
** ComfyUI-Manager config path: /app/ComfyUI/user/__manager/config.ini
** Log path: /app/ComfyUI/user/comfyui.log
[PRE] ComfyUI-Manager
Found comfy_kitchen backend eager: {'available': True, 'disabled': False, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_mxfp8', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8', 'scaled_mm_mxfp8', 'scaled_mm_nvfp4']}
Found comfy_kitchen backend cuda: {'available': True, 'disabled': False, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8', 'scaled_mm_nvfp4']}
Found comfy_kitchen backend triton: {'available': True, 'disabled': True, 'unavailable_reason': None, 'capabilities': ['apply_rope', 'apply_rope1', 'dequantize_nvfp4', 'dequantize_per_tensor_fp8', 'quantize_mxfp8', 'quantize_nvfp4', 'quantize_per_tensor_fp8']}
Checkpoint files will always be loaded safely.
Total VRAM 24081 MB, total RAM 129024 MB
pytorch version: 2.13.0.dev20260422+cu130
Set vram state to: NORMAL_VRAM
Device: cuda:0 NVIDIA GeForce RTX 4090 : cudaMallocAsync
Using async weight offloading with 2 streams
Enabled pinned memory 116121.0
Using pytorch attention
DynamicVRAM support detected and enabled
Python version: 3.12.3 (main, Mar 23 2026, 19:04:32) [GCC 13.3.0]
ComfyUI version: 0.19.3
comfy-aimdo version: 0.2.14
comfy-kitchen version: 0.2.8
ComfyUI frontend version: 1.42.14
[Prompt Server] web root: /usr/local/lib/python3.12/dist-packages/comfyui_frontend_package/static
Asset seeder disabled
[START] ComfyUI-Manager
[ComfyUI-Manager] Using GitPython backend
### Loading: ComfyUI-Manager (V4.2.1)
[ComfyUI-Manager] network_mode: personal_cloud
### ComfyUI Version: v0.19.3-37-g443074ee | Released on '2026-04-23'
[ComfyUI-Manager] Legacy UI is enabled.
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/custom-node-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/alter-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/github-stats.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/model-list.json
[ComfyUI-Manager] default cache updated: https://raw.githubusercontent.com/Comfy-Org/ComfyUI-Manager/main/extension-node-map.json
Skipping loading of custom nodes
Context impl SQLiteImpl.
Will assume non-transactional DDL.
Context impl SQLiteImpl.
Will assume non-transactional DDL.
Running upgrade -> 0001_assets, Initial assets schema
Revision ID: 0001_assets
Revises: None
Create Date: 2025-12-10 00:00:00
Running upgrade 0001_assets -> 0002_merge_to_asset_references, Merge AssetInfo and AssetCacheState into unified asset_references table.
Running upgrade 0002_merge_to_asset_references -> 0003_add_metadata_job_id, Add system_metadata and job_id columns to asset_references.
Change preview_id FK from assets.id to asset_references.id.
Database upgraded from None to 0003_add_metadata_job_id
Starting server

To see the GUI go to: http://0.0.0.0:8188
To see the GUI go to: http://[::]:8188
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui/components/buttonGroup.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
[DEPRECATION WARNING] Detected import of deprecated legacy API: /scripts/ui/components/button.js. This is likely caused by a custom node extension using outdated APIs. Please update your extensions or contact the extension author for an updated version.
FETCH ComfyRegistry Data [DONE]
[ComfyUI-Manager] default cache updated: https://api.comfy.org/nodes
FETCH DATA from: /usr/local/lib/python3.12/dist-packages/comfyui_manager/custom-node-list.json [DONE]
[ComfyUI-Manager] All startup tasks have been completed.
Error handling request from 198.105.124.138
Traceback (most recent call last):
File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_protocol.py", line 517, in _handle_request
resp = await request_handler(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_app.py", line 569, in _handle
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/dist-packages/aiohttp/web_middlewares.py", line 117, in impl
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/app/ComfyUI/middleware/cache_middleware.py", line 27, in cache_control
response: web.Response = await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/app/ComfyUI/server.py", line 86, in deprecation_warning
response: web.Response = await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/app/ComfyUI/server.py", line 180, in origin_only_middleware
response = await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/__init__.py", line 128, in manager_middleware
response: web.Response = await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/legacy/manager_server.py", line 787, in queue_batch
await update_comfyui(None)
File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/legacy/manager_server.py", line 1600, in update_comfyui
rejection = manager_security.reject_simple_form_post(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/dist-packages/comfyui_manager/common/manager_security.py", line 65, in reject_simple_form_post
if request.content_type in _SIMPLE_FORM_CONTENT_TYPES:
^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'content_type'
```

### Other

Update All obviously affected as well