`PUT User` shouldn't permit using existing `user_login` or `user_nicename`

Discovered in #705