Only allow user to update self