add a PUT endpoint for full-entity updates
- mostly to show that if this exists, handling PATCH adds very little extra code
- also, added some validation that earlier PATCH handling didn't do -- like make sure someone didn't try to change the 'id' value