[Rebecca] - only people who can manage users should have access to the user update page