This is AFAIK insecure, as it allows any user to change the display name of other users. - Not good :-)

(Or am I missing something? - Didn't test it locally, just had a look at the source)