update user (no admin)