A user's public_key is the only attribute they should be able to update via API.