Api edit pkg

In the API, I don't see how else we could do it.

Note that in the UI, there is CSRF protection enabled :)