devonatdomandtom

@ mrfelton I wonder if these are valid tests? If we're only updating readonly model attributes, shouldn't we return a 403? Can I amend the test?

I've created a PR for this. Hopefully it is accepted.