create an object in a specified location on PUT.  PUT is also public
now, since it handles security by itself.