Upsert per user. 200 rather than 201: the second call updates a row it did not create,
and answering 201 both times would tell a client it made two ratings.
The body shows the fields the schema always carries. Which combination is legal is a service rule the schema cannot express, so read the description above before copying this.