* app/user: check if username or email is in use before patching a user * reflect review comments * fix tests