UpdateUser appears to create user if it doesn't exist

I'm still investigating but it appears that calls to `UpdateUser` rpc create the user if it doesn't exist. 

## Expected Behaviour
`UpdateUser` only updates existing users.

## Current Behaviour
`UpdateUser` creates a new user if the user that is provided in the request does not already exist.

## Possible Solution
we could refactor to check for user existence first.

