add PATCH #update to UsersController, tests