since the model generally doesn't know about the current user, the `updated` and `updatedBy` properties can only be updated in the controller.