api/users: use proper update method