Perhaps accepting the T&C shouldn't go through the generic updateUser feed? We could have a separate endpoint for accepting the Terms and Conditions, which makes it easier to whitelist the API endpoints that don't require the T&C to be accepted.