title: Simperium username update doesn't require accurate password
body: <p>I'm setting up custom account management for my Simperium app, based on the recommendation from the answer in <a href="https://stackoverflow.com/questions/15604916/simperium-can-a-user-recover-a-forgotten-password">Simperium - Can a user recover a forgotten password ..?</a>, and referencing the <a href="https://simperium.com/docs/reference/http/#update" rel="nofollow noreferrer">API documentation</a>. </p>
  
  <p>This all in PHP, handling the form creation and submission.</p>
  
  <p>I've created the curl request as follows, a format which I've already tested for password resets, using the "<a href="https://simperium.com/docs/reference/http/#reset_password" rel="nofollow noreferrer">reset_password</a>" url. </p>
  
  <pre><code>$curl = curl_init();
  curl_setopt_array($curl, array(
      CURLOPT_HTTPHEADER =&gt; array('X-Simperium-API-Key: &lt;my_admin_API_key&gt;'),
      CURLOPT_POSTFIELDS =&gt; '{"username": "'.$username.'", "password" :"'.$password.'", "new_username":"'.$newusername.'"}',
      CURLOPT_POST =&gt; TRUE,
      CURLOPT_RETURNTRANSFER =&gt; TRUE,
      CURLOPT_URL =&gt; 'https://auth.simperium.com/1/&lt;my_app_id&gt;/update/'
  ));
  </code></pre>
  
  <p>The problem I'm having, is that during testing, I've found that it will take any password I enter, and return: </p>
  
  <pre><code>{"status": "success"}
  </code></pre>
  
  <p>Further testing showed that the username was, in fact, changed. </p>
  
  <p>I realize this isn't a "question", per se, but Simperium support seems to be most responsive to Stackoverflow posts.</p>