Test that updates to user profile are refused without auth_token