What happens if a user tries to turn on auto updates for a theme or plugin outside the wp org directory?