add query options to find, only allow queried fields to be updated