We should only update the work data properties that we let the user control (i.e. metadata, visibility and state), rather than taking anything that's coming in the request.  We also need to check, like in `create_work` that the values for visibility and state are valid.