fixed permissions on users#set_email