Eep. We need to check that `handle_update` can't override `user_account` either.