Fixed permission checking for email/password update.