can update email and username
making room for confirm email feature
intentionally simplified authorization logic