setup PUT /users/:id endpoint & deny unauthed access