TODO: check that a team cannot update its own id

In the team model, a team calls `update` with the request body coming into the API. We should write a test to see what happens when the request body includes a different id. Does this overwrite the team id?

Start by locating the team model and the API update path that passes the request body to update. Add a test whose request body contains a different id, then run the relevant team-model or API test suite. Done means the test clearly records whether the team's id can be overwritten.

Written by the indexing model from the issue text.