WIP: 'update' action needs to leave password unaltered, skip password validation