Allow user to update their own username and password, but not role

Finishes up #178.