- [x] use `PUT` instead of `POST` in update methods - [ ] get `id`s in the request body instead of the URL