Users should be able to change their password. Managers are the only ones that are able to change the role of a user