fix: update_positions is not a rest action so it should not call load_resource

this was also preventing custom abilities.