previously, we did not allow updates to its own metadata by default. this is a bit too restrictive, as the primary users of metadata/attributes are clients and agents. vs server-api with admin access.