Update staff should not be secured by AccessControl filter