Removing security flaw (possibility to update directly from json call)
now handled by index.php through POST messages for logged user only

Still had to manage that a user cannot tweek its http query to update someone else data