test that client cannot update itself