bug on permissions on User::update