user_endpoints: disallow changing username