fix: PUT user/{id} now has scope defined properly