I think this route is named poorly.  I wonder if this should really be `/api/sync/updates`?