title: DRF serializer update nested user
body: <p>i'm using Django 1.11 and the Django Rest Framework in order to create an API, where a user can create and update an employee which is related to the django user model.<br>
  The stripped down code i've got looks like this:</p>
  
  <p>I've got this model:  </p>
  
  <pre><code>class Employee(models.Model):
      user = models.OneToOneField(User, on_delete=models.CASCADE, related_name='employee')
      uuid = models.UUIDField(primary_key=True, default=uuid.uuid4, editable=False)
  </code></pre>
  
  <p>these two viewsets:</p>
  
  <pre><code>class UserViewSet(viewsets.ModelViewSet):
      serializer_class = serializers.UserSerializer
      permission_classes = [permissions.IsAuthenticated]
  </code></pre>
  
  <p>and</p>
  
  <pre><code>class EmployeeViewSet(viewsets.ModelViewSet):
      serializer_class = serializers.EmployeeSerializer
      permission_classes = [permissions.IsAuthenticated]
  </code></pre>
  
  <p>and these two serializers:</p>
  
  <pre><code>class UserSerializer(serializers.HyperlinkedModelSerializer)
      class Meta
          models = User
          fields = ('url', 'id', 'username', 'email', 'is_staff', 'first_name', 'last_name', 'password')
          read_only_field = ('id',)
  
      def validate(self, data)
          # ... Check if data is valid and if so...
          return data
  </code></pre>
  
  <p>and</p>
  
  <pre><code>class EmplyoeeSerializer(serializers.HyperlinkedModelSerializer):
      user = UserSerializer()
      class Meta:
          model = Employee
          field = ('url', 'uuid', 'user')
          read_only_field = ('uuid')
  
      def validate(self, data):
          return data
  
      def create(self, validated_data):
          user = User(**validated_data['user'])
          user.save()
          employee = Employee(user=user)
          employee.save()
          return employee
  
      def update(self, employee, user):
          employee.user.username = user.username
          employee.user.email = user.email
          employee.user.first_name = user.first_name
          employee.user.last_name = user.last_name
          employee.user.is_staff = user.is_staff
          # ... Check if password has changed, and if so...
          employee.user.set_password(user.password)
          employee.user.save()
          employee.save()
          return employee
  </code></pre>
  
  <p>also i've got these two routers in my urls.py</p>
  
  <pre><code>router = routers.DefaultRouter()
  router.register(r'api/user', views.UserViewSet, base_name='user')
  router.register(r'api/employee', views.UserViewSet, base_name='employee')
  </code></pre>
  
  <p>Creating and updating an instance of user is no problem.<br>
  I can also create an employee which in return will create an user and then an employee assigend to that user.<br>
  I can even update the username of the employee and the user will get updated too,<br>
  but i can't update first_name, last_name, email, is_staff and password.<br>
  DRF keeps telling me that the username is already taken, but when i change the username and other information like first_name and last_name and then send a PUT request to the server, the employee and associated user instance are getting updated properly.<br>
  What am i missing?<br>
  Why can't i update the employees user instance like i can update the normal user instance when i'm at the user api endpoint? :/</p>
  
  <p>Thanks in advance,<br>
  any help would be appreciated.</p>