Allow user to update self only