prevent user from changing email,
change userEntityService update method to only allow a limited set of
whitelisted fields to be updated for a user