An Authenticated User can update other users

```
router
.route('/:userId')
.patch(auth(), validate(userValidation.updateUser), userController.updateUser);
```
The above endpoint allows an authenticated user to update another user.

How can we restrict a user updating another user's data but allow updating his data?

Start with the shown PATCH /:userId route and trace auth(), userValidation.updateUser, and userController.updateUser. Check how the authenticated user's identity is exposed and how the controller selects the target user. Done means an authenticated user can update their own data but receives an authorization failure when targeting another user.

Written by the indexing model from the issue text.