Is there a best form for security surrounding updating an entity of an unspecified type? In Drupal 7, I have a field on both nodes and users that I'd like to update from a single function.  What's the most efficient and what is best practice for updating by entity id?

I want the client to hit my Services REST API endpoint with an entity id and value.  So far I've got:

function json_field_resource_update($entity_id = NULL, $data = array()) {
  global $user;

  $entity_type = 'user';
  $entity = entity_load_single($entity_type, $entity_id);
  if (!$entity) {
    $entity_type = 'node';
    $entity = entity_load_single($entity_type, $entity_id);
  }
  if (!$entity) {
    return services_error(t('No user or node entity found by entity_id !entity_id', array('!entity_id' =&gt; $entity_id)), 406);
  }
  if (!entity_access('update', $entity_type, $entity)) {
    return services_error(t('Permission denied for !user to update entity !entity_id', array('!user' =&gt; $user-&gt;name, '!entity_id' =&gt; $entity_id)), 403);
  }
...


The purpose of the above is to first check whether this entity Id refers to a user or a node then perform the appropriate access check.  This works ok, but am I missing some magical all-in-one Entity API function or something?
I think the entity metadata wrapper is semi indiscriminate aslong as the field is the exactly the same on both entities. So you can just wrap it and then use the default set/get methods 

// All your code (it looks fine) 
$wrapper = entity_metadata_wrapper($entity_type, $entity);
$wrapper-&gt;FIELD_TO_SET-&gt;set(VALUE);
$wrapper-&gt;save(); 


More info on the metadata wrapper