update resource PUT to take full update, fix request payload parsing to account for EJSON values, proper whitelisting