uniform url action (update/retrieve/create) and UserUpdate permissions