Don't expose language and password as editable

* Password might not always be editable
  - Also chaging that will invalide apptokens etc which will directly
  lock out your phone
* Chaging the language also doesn't make that much sense to me currently

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

apps/provisioning_api/lib/Controller/UsersController.php

@@ -309,11 +309,6 @@ class UsersController extends OCSController {
 			$permittedFields[] = AccountManager::PROPERTY_EMAIL;
 		}
 
-		$permittedFields[] = 'password';
-		if ($this->config->getSystemValue('force_language', false) === false) {
-			$permittedFields[] = 'language';
-		}
-
 		if ($this->appManager->isEnabledForUser('federatedfilesharing')) {
 			$federatedFileSharing = new \OCA\FederatedFileSharing\AppInfo\Application();
 			$shareProvider = $federatedFileSharing->getFederatedShareProvider();