Reject document bodies for PUT/POST that contain user defined top level properties starting with '_'

fixes issue #507