User.findByIdAndUpdate does no validation; replaced with .find()+.validate()+.update(). All PUT tests working