Only a system admin or a user w/ Manage Users & Role System Permission should be able to change a user's  username or email address fields & be able to do this only from the Admin | Users & Roles tab.

1) When a user is editing their own profile, gray out both the username & email address fields (no matter what permissions they have, even if they are an admin)

2) Only the Admin | Users & Role tab | Edit user screen is where both username & email address editable

3) Ensure the above logic is enforced on the server

Update unit tests to test the above checks.