Deny access to user edit action for low-priv users

Previously you could open the user edit page but not successfully make
changes if you didn't have permission to edit that user. Now you won't
be able to view that page at all.

The edit page shows that user's settings and the "identity" half of
their API keys, which shouldn't be accessible.

(cherry picked from commit 4193c1b)

application/src/Controller/Admin/UserController.php

@@ -139,6 +139,11 @@ public function editAction()
         $readResponse = $this->api()->read('users', $id);
         $user = $readResponse->getContent();
         $userEntity = $user->getEntity();
+
+        if (!$this->userIsAllowed($userEntity, 'update')) {
+            throw new Exception\PermissionDeniedException;
+        }
+
         $currentUser = $userEntity === $this->identity();
         $keys = $userEntity->getKeys();