ensuring view users cannot change password