Allow user to update their own username and password, but not role