it's not clear looking at this which user is authorized to do this. It should be cluster admins, database admins, or if the requesting user matches the user object being requested. Is that the case?