Don't let POST to /admin/users/me