user update should proc with api key and cookie login too