Updated to include PATCH /users/:id

No, no exceptions. Basic for everyone, with a middleware check