only use post method to do update for security reasons