Updated ACL for user model

Current ACL property for user has wrong value.

It should be upsert to allow owners to update their models. REST doesn't support updateAttributes