@RequestMapping(path = "/collection/{collectionId}/item/{itemId}", method = PUT)
 @PreAuthorize(
     "hasRole('ADMIN') || hasPermission(#itemId, 'org.bossie.security.domain.Item', 'write')")
 public @ResponseBody void updateItem(@PathVariable long itemId, @RequestBody Object item) {
   securityService.updateItem(itemId, item);
 }