static async apiUpdateUser (req, res) {
    const userId = ArkimeUtil.sanitizeStr(req.params.id);

    delete req.body.userId; // Make sure nothing uses this

    if (!ArkimeUtil.isString(userId)) {
      return res.serverError(403, 'Missing userId');
    }

    const isRole = userId.startsWith('role:');

    if (userId === '_moloch_shared') {
      return res.serverError(403, "_moloch_shared is a shared user. This user's settings cannot be updated");
    }

    if (systemRolesMapping[userId]) {
      return res.serverError(403, `User ID can't be a system role id`);
    }

    if (req.body.roles !== undefined && !ArkimeUtil.isStringArray(req.body.roles)) {
      return res.serverError(403, 'Roles field must be an array of strings');
    }

    req.body.roles ??= [];

    if (!User.validateRoles(req.body.roles)) {
      return res.serverError(403, 'User roles must be system roles or start with "role:"');
    }

    const rolesSet = await User.roles2ExpandedSet(req.body.roles);
    const iamSuperAdmin = req.user.hasRole('superAdmin');
    if (isRole && (rolesSet.has(userId) || req.body.roles.includes(userId))) {
      return res.serverError(403, `Can't have circular role dependencies`);
    }

    if (isRole && req.body.roles.includes('superAdmin')) {
      return res.serverError(403, `User defined roles can't have superAdmin`);
    }

    if (isRole && ArkimeUtil.arrayIncludes(req.body.roles, adminRoles)) {
      return res.serverError(403, `User defined roles can't have a system Admin role`);
    }

    if (req.body.roleAssigners && !ArkimeUtil.isStringArray(req.body.roleAssigners)) {
      return res.serverError(403, 'roleAssigners field must be an array of strings');
    }

    if (req.body.roles.includes('superAdmin') && !iamSuperAdmin) {
      return res.serverError(403, 'Can not modify superAdmin unless you are superAdmin');
    }

    User.getUser(userId, async (err, user) => {
      if (err || !user) {
        console.log(`ERROR - ${req.method} /api/user/%s`, userId, util.inspect(err, false, 50), user);
        return res.serverError(403, 'User not found');
      }

      if (user.hasRole('superAdmin') && !req.body.roles.includes('superAdmin') && !iamSuperAdmin) {
        return res.serverError(403, 'Can not disable superAdmin unless you are superAdmin');
      }

      // userAdmin can disable Admin roles but can not enable new ones
      if (!iamSuperAdmin && adminRoles.some(v => rolesSet.has(v) && !user.hasRole(v))) {
        return res.serverError(403, 'Only superAdmin user can enable Admin roles on a user');
      }

      user.enabled = req.body.enabled === true;

      if (ArkimeUtil.isString(req.body.expression, 0)) {
        if (req.body.expression.match(/^\s*$/)) {
          delete user.expression;
        } else {
          user.expression = req.body.expression;
        }
      }

      if (ArkimeUtil.isString(req.body.userName)) {
        if (req.body.userName.match(/^\s*$/)) {
          return res.serverError(403, 'Username can not be empty');
        } else {
          user.userName = req.body.userName;
        }
      }

      user.webEnabled = req.body.webEnabled === true;
      user.emailSearch = req.body.emailSearch === true;
      user.headerAuthEnabled = req.body.headerAuthEnabled === true;
      user.removeEnabled = req.body.removeEnabled === true;
      user.packetSearch = req.body.packetSearch === true;
      user.hideStats = req.body.hideStats === true;
      user.hideFiles = req.body.hideFiles === true;
      user.hidePcap = req.body.hidePcap === true;
      user.disablePcapDownload = req.body.disablePcapDownload === true;
      user.timeLimit = req.body.timeLimit ? parseInt(req.body.timeLimit) : undefined;
      user.roles = req.body.roles;
      user.roleAssigners = req.body.roleAssigners ?? [];

      User.setUser(userId, user, (err, info) => {
        if (ArkimeConfig.debug) {
          console.log('setUser', user, err, info);
        }

        if (err) {
          console.log(`ERROR - ${req.method} /api/user/%s`, userId, util.inspect(err, false, 50), user, info);
          return res.serverError(500, 'Error updating user:' + err);
        }

        return res.send(JSON.stringify({
          success: true,
          text: `User ${userId} updated successfully`
        }));
      });
    });
  }
POST - /api/user/:id

Updates a user (admin only).
@name /user/:id
@returns {boolean} success - Whether the update user operation was successful.
@returns {string} text - The success/error message to (optionally) display to the user.