API endpoint for updating user