Check permission based on provided data on user updates

Fixed a permission check issue where user update operations were not correctly validating permissions based on the actual provided data, which could have allowed unauthorized modifications.

Source: original entry ↗