api: allow PUT /user to update tasks for now, will change lager