Never occurred to me the illogic of running update security checks on the passed object data.  Added code so that update security checks load the object from the db and check access to that.