fix(core): User update endpoint should only allow updating email, firstName, and lastName#5526