@abstractj the thought here is that the the "update" endpoint is secured with the @user role.  this is so you can't just change your password from cURL anytime you want. and once you are "fully" authenticated, we remove the temporary user role