in obj.upsertFromUntrusted allow lookup to be the id string