disallow changing of username etc