Only allow users to modify themselves via API