API user update method can only update the currently authenticated user