Previously, when users were updated, we did not use the fields on the
user that was being persisted. As a result, the API responded with the
attribute being set, but the updated values were not actually stored in
bolt. This was not noticed previously because SuperAdmins had raw access
to the UsersStore