Allow PUT for policy attribute via REST API