allowed PATCH requests