Revert "simplify updateUser and have it use validating code path"

This reverts commit 967aa99ac09d14d4b5ef494c66c516b2d7346dcb.
Revert "test that updateSelf will not update other users"

This reverts commit 224fb19596e6898b1085dad82e390217cf89e40f.
adjust remove groups validation