User update: Use strong_parameters, disallow status change