add put to insert should return forbidden test
fix invalid json
implement forbidden for put insert/add