Don't push customer data back unless request is from admin.  Extend customer api so that passwords will always be updated.