exclude fields that shouldn't be updated by UserUpdateForm and UserProfileUpdateForm
excluded fields: email, password, has_username_set