check permissions before changing the display name
remove debug output
prevent xss
only change display name if the display name from the current user was changed; add correct display name to new user