it seems that filtered attributes are not wrapped automatically.  This was forcing the user to wrap the payload with root load 'user' to create the object.
https://www.bountysource.com/issues/336019-password-attribute-not-wrapped-by-default-when-using-has_secure_password