upsert: more tests required regarding permissions

[remyla]

User was able to call upsert when update was failing.

• update returns ["null","null”] (probably because the user was not the author of the updated elements)

In order to confirm this and improve:

• reproduce the update failure
• reproduce the upsert success which should be denied
• if confirmed
  • add the tests in nodejs-tests to produce an error
  • investigate the permissions to resolve the issue