Fix vulnerability

[drinkingChai]

Remove keys from req.body PUT /api/users so that users can't set themselves as admins:

• isAdmin
• isDisabled
• passwordChange