code: function updateSecure(user, options) {
      // jscs:disable
      // jshint -W040
      const self = this;
      // jshint +W040
      // jscs:enable
      const Model = self.constructor;
      const shield = Model.shield;
      const action = 'update';
      const rules = shield.getApplicableRules(action);
      const primaryKey = Model.idAttribute;
      const query = {};
      const tmpModel = Model.forge(query);
  
      // validate that the model isNew
      if (self.isNew()) {
          return Promise.reject(
              new AuthError('attempt to update a new record')
          );
      }
  
      query[primaryKey] = self.get(primaryKey);
      return tmpModel.read(user)
          .then(function validateUpdatePrivs(originalModel) {
              // TODO: investigate what happens if fetch returns nothing (err?)
              return applyRules(rules, originalModel, user);
          }).then(function executeUpdate() {
              return shield._save.call(self, options);
          });
  }
docs: update an existing record in DB after verifying privs
  Permissions are validated against the current record in DB
  @param {object} user is the user credentials
  @param {object} options are options to be passed to save call
  @return {Promise} resolves to save result or rejects with auth error