upto 3.16

app/controllers/users_controller.rb

@@ -39,13 +39,9 @@ class UsersController < ApplicationController
 
   # PATCH/PUT /users/1 or /users/1.json
   def update
-    if not @user == current_user
-      redirect_to user_path(@user), notice: "User not authorized to edit this user"
-      return
-    end
 
     respond_to do |format|
-      if @user.update(user_params)
+      if user_params[:username].nil? && @user == current_user && @user.update(user_params)
         format.html { redirect_to user_url(@user), notice: "User was successfully updated." }
         format.json { render :show, status: :ok, location: @user }
       else

app/views/users/_form.html.erb

@@ -13,10 +13,12 @@
     </div>
   <% end %>
 
-  <div>
-    <%= form.label :username, style: "display: block" %>
-    <%= form.text_field :username %>
-  </div>
+  <% if @user.new_record? %>
+    <div>
+      <%= form.label :username, style: "display: block" %>
+      <%= form.text_field :username %>
+    </div>
+  <% end %>
 
   <div>
     <%= form.label :password, style: "display: block" %>