Shouldn't this URL include the loan account ID as well? This would at least be REST compliant, otherwise semantically it means you want to update the whole loans collection.