fix(auth): prevent users from gaining additional permissions

[Bohreromir]

Users were able to pose as any other user in trino queries.
Can be done by logging in as bob and executing

await fetch('/api/auth/update-user', {
  method: 'POST',
  headers: { 'content-type': 'application/json' },
  credentials: 'include',
  body: JSON.stringify({ username: 'alice' })
});

in the browser console.
The fix prevents the username to be changed