use POST for create and PUT for update

You'll need to return a `Location:` header + 201 here.