Improve User.plugins= method and fix new spec from master rails as

we allows only plugins which updating user have to update user.
you know security..