TODO: check that a team cannot update its own id

[kamicut]

In the team model, a team calls update with the request body coming into the API. We should write a test to see what happens when the request body includes a different id. Does this overwrite the team id?

[guidorice]

We also noticed this from the swagger ui.