Move logic for updating a user to a service class

This cleans up the controller a bit and isolates the logic for updating a user. I also added some test coverage.