update authorization for modifying users