diff --git a/app/models/ability.rb b/app/models/ability.rb
index 9d1b69ef31..66d1d0056b 100644
--- a/app/models/ability.rb
+++ b/app/models/ability.rb
@@ -161,6 +161,11 @@ def custom_permissions(user=nil, session=nil)
         # anyone who can edit a media_object can also push it
         can? :edit, media_object
       end
+
+      can :json_update, MediaObject do |media_object|
+        # anyone who can edit a media_object can also update it via the API
+        is_api_request? && can?(:edit, media_object)
+      end
     end
   end
 
diff --git a/config/puma.rb b/config/puma.rb
index 8db23e7813..2f32227c90 100644
--- a/config/puma.rb
+++ b/config/puma.rb
@@ -1,4 +1,4 @@
 bind 'tcp://0.0.0.0:3000'
 ssl_bind '0.0.0.0', '3001', 
-  cert: File.join(ENV['HOME'], '.dev_cert', 'dev.rdc.cert.pem'),
-  key: File.join(ENV['HOME'], '.dev_cert', 'dev.rdc.key.pem')
\ No newline at end of file
+  cert: ENV['SSL_CERT'],
+  key: ENV['SSL_KEY']
\ No newline at end of file