Add a mechanism to prevent update races

[mike-marcacci]

Like most CRUD APIs, this API doesn't have any concept of SQL-like "transactions" that can hold locks on the state while the application does its thing. Because of this there's always the risk of unintentionally clobbering a concurrent change when a write is conditional on a prior read.

This can be alleviated by adding an optional fromRecordId field to all "update" operations. When set, AuthX can ignore

This depends on #33 and #73.