patch users uses req.user if given id is -1