code: def put(self, user_id):
          
          self.reqparse.add_argument('roles', type=str, action='append')
          args = self.reqparse.parse_args()
          auditlog(event='user.create', actor=session['user'].username, data=args)
  
          user = db.User.find_one(User.user_id == user_id)
          roles = db.Role.find(Role.name.in_(args['roles']))
          if not user:
              return self.make_response('No such user found: {}'.format(user_id), HTTP.NOT_FOUND)
  
          if user.username == 'admin' and user.auth_system == 'builtin':
              return self.make_response('You cannot modify the built-in admin user', HTTP.FORBIDDEN)
  
          user.roles = []
          for role in roles:
              if role in args['roles']:
                  user.roles.append(role)
  
          db.session.add(user)
          db.session.commit()
  
          return self.make_response({'message': 'User roles updated'}, HTTP.OK)
docs: Update a user object