title: Django: How to update user model without updating user password field
body: <p>I'm trying to create a user update endpoint that only updates select fields of a user. My currently implementation is to save the model with ModelForm's save method but I've also tried with the base model save method. </p>
  
  <p>My request body doesn't contain a password field and I don't have a password field in my UserForm, however I'm unable to maintain the current session or logout and log back in with the current user after executing an update. I'm nearly positive this is because Django is changing my password somewhere during the update process.</p>
  
  <p>Other pertinent information: I'm using Django (not Django Rest Framework). I have a custom user model. I know I can solve this issue by using serializers with DRF but it seems hacky to use that for this issue alone.</p>
  
  <p>My endpoint looks like this:</p>
  
  <pre><code>def saveAccountData (request):
      resp = {}
      if request.method == 'POST':
          form = UserForm(request.POST, instance=request.user)
          if form.is_valid():
              form.save()
  
              resp['result'] = 'User updated'
              return HttpResponse(
                  json.dumps(resp),
                  status=200
              )
          else:
              return HttpResponse(
                  json.dumps(form.errors),
                  status=422,
              )
  </code></pre>
  
  <p>My Form looks like this:</p>
  
  <pre><code>class UserForm(forms.ModelForm):
      class Meta:
          model = User
          fields = ['email', 'name', 'is_active', 'is_admin']
  
      def save(self, commit=True):
          user = super(UserForm, self).save(commit=False)
          user.name = self.cleaned_data['name']
  
          if commit:
              user.save()
          return user
  </code></pre>
  
  <p>User model:</p>
  
  <pre><code>from django.db import models
  from django.contrib.auth.models import AbstractBaseUser, BaseUserManager, PermissionsMixin
  from django.conf import settings
  import logging
  
  class UserManager(BaseUserManager):
  
      def create_user(self, email, name, password=None):
          # executes if email is zero (false) or an empty container (equivalent to None)
          logger = logging.getLogger(__name__)
          logger.warning('Create user: ' + password)
          if not email:
              raise ValueError("Please provide an email address")
  
          if not password:
              raise ValueError("Please enter a password")
  
          if not name:
              raise ValueError("Please enter your name")
  
          # normalize email address (convert to lower case so all email addresses are standardized)
          user = self.model(
              email = self.normalize_email(email),
              name=name,
          )
          # the set_password method encrypts the password
          user.set_password(password)
          user.save(using=self._db)
  
          return user
  
      def create_superuser(self, email, password, name):
          user = self.create_user(
              email, 
              password=password, 
              name=name)
  
          user.is_superuser = True
          user.is_admin = True
          user.save(using=self._db)
  
          return user
  
  class User(AbstractBaseUser, PermissionsMixin):
  
      email = models.EmailField(max_length=50, unique=True)
      password = models.CharField(max_length=100)
      name = models.CharField(max_length=100)
      phone = models.CharField(max_length=20)
      city = models.CharField(max_length=50)
      state = models.CharField(max_length=20)
      is_active = models.BooleanField(default=True)
      is_admin = models.BooleanField(default=False)
  
      objects = UserManager()
      # we must specify a username field
      USERNAME_FIELD = 'email'
      # required fields are used for create_superuser
      REQUIRED_FIELDS = ['name']
  
      def get_full_name(self):
          return self.name
  
      def get_short_name(self):
          return self.name
  
      def __str__(self):
          # django uses this method when it needs to convert an object to a string
          return self.email
  </code></pre>