add patch method, dont allow id on create
add route for patch