edit with req body instead of req.params