It was checking for the permission to create a user which everyone can
do. Now it's checking for updating that particular user and doesn't
allow generating new keys for other users any more.
This would have been an inconvenience but not a big security issue
because you can't view the key of another user.