[#1977] stricter PUT /user set-path validation, require they're setting on a
leaf-path (except for tasks.* - we still need to handle that properly)