can perform put and deletes on user as long as there is not a . char in the urls :id parameter (ask Tom about this).