Your Merge Function Gave Every Object Admin Rights

The settings endpoint was simple. Take the JSON from the request. Deep merge it into the user's...