Update operation for resource without an ID should fail

[jimsteel]

Doing a PUT on a resource that doesn't have an ID in the body should fail with 400, but succeeds (and copies the id from the URL into the resource. Related to #305

[jamesagnew]

This is actually something we recently changed to make the server a bit more tolerant of user error. When doing a create:

• If the ID in the resource body and the URL don't agree, the server rejects the request with HTTP 400
• If the resource body has no ID and the URL has one, the server logs a warning (iirc?) but ultimately lets the operation through

Obviously this is contrary to the spec, but it seems like this is a place where applying Postel's law makes sense since the user's intentions are fairly clear. Would it make sense to add a "strict" mode where this kind of thing results in an error?

[jamesagnew]

Fixed in #521