user update supports JSON body