Removed code allowing the user API to update any user