Secured POST update on user resource