make round-trip GET/PUT safe (zapping TODO)