All feature settings are replaced by the received object so the use of
PATCH does not make sense here. The session is "patched" but the HTTP
verb always relates to the URL which refers explicitly to features in
this case.

See https://tools.ietf.org/html/rfc5789.