diff --git a/components/metrics/MetricsTable.js b/components/metrics/MetricsTable.js
index 2e20dfc6..8dfae971 100644
--- a/components/metrics/MetricsTable.js
+++ b/components/metrics/MetricsTable.js
@@ -35,10 +35,7 @@ export default function MetricsTable({
   const { get, useQuery } = useApi();
 
   const { data, isLoading, isFetched, error } = useQuery(
-    [
-      'websites:metrics',
-      { websiteId, type, modified, url, referrer, os, browser, device, country },
-    ],
+    ['websites:metrics', websiteId, type, modified, url, referrer, os, browser, device, country],
     () =>
       get(`/websites/${websiteId}/metrics`, {
         type,
diff --git a/pages/api/me/password.ts b/pages/api/me/password.ts
index 55a9993b..70d8de5f 100644
--- a/pages/api/me/password.ts
+++ b/pages/api/me/password.ts
@@ -1,5 +1,4 @@
 import { NextApiRequestQueryBody, User } from 'lib/types';
-import { canUpdateUser } from 'lib/auth';
 import { useAuth } from 'lib/middleware';
 import { NextApiResponse } from 'next';
 import {
@@ -9,7 +8,6 @@ import {
   methodNotAllowed,
   forbidden,
   ok,
-  unauthorized,
 } from 'next-basics';
 import { getUser, updateUser } from 'queries';
 
@@ -33,13 +31,9 @@ export default async (
   await useAuth(req, res);
 
   const { currentPassword, newPassword } = req.body;
-  const { id } = req.query;
+  const { id } = req.auth.user;
 
   if (req.method === 'POST') {
-    if (!(await canUpdateUser(req.auth, id))) {
-      return unauthorized(res);
-    }
-
     const user = await getUser({ id }, { includePassword: true });
 
     if (!checkPassword(currentPassword, user.password)) {