Fixed API & Commands test cases (localy at least)
Improved user authorization, update is allowed for proper user (staff or owner)