routes: deny update of self user.email

Signed-off-by: Sergei Ianovich <s@asutp.io>