How to prevent users editing their profile, but allow password change? I have a Drupal 7 site that has additional fields added to the user profile page, to capture additional information (with these fields then displayed on the public-facing profile).

Only administrators should be able to edit non-admin profiles.

However, I am using !login_url (one time login) functionality in email confirmations to allow new users to set their own password and I need to retain this feature.

I have installed the User Protect module, but unless I enable the 'Edit own user account' permission, the one time login link returns a 'You are not authorized to access this page' message and the password cannot be entered.

Is there a way via User Protect, another module, or via custom code for me to retain the Change Password option, but remove access to all other fields that have been added to build a more complete profile?
You might be able to use the module: Password Hustle


  Adds the password set form as an optional fields on the one click
  login. In other words, we encourage (hustle) the user into setting
  their password as they log into the site via a one click login.