Privileges rights only works on specific updates

[gahabeen]

Meaning that to update a specific field like _auth.email, even if the user has the right to do it, he would need to do a specific update (operation) for it and so cannot be merge within another operation.

Not sure if that's wanted behavior or not yet.