fixed it so that annonymous users can actually edit the attributes field on PUT requests