Issue title: Update Settings: Properly ignore settings that are not allowed to be updated dynamically
 Issue body: Update Settings: Properly ignore settings that are not allowed to be updated dynamically. (Currently, everything is passed, which is bad since its confusing).

 Comments: 
 Comment 0: This kind of solves a part of #981.
It depends on whether you actually do or don't want to give the ability to use GET parameters for the PUT or POST updating the settings. Anyways, `pretty` (the only legal parameter for update settings I think) won't be taken as a setting anymore.
Further discussion on #981?

 Comment 1: Yea, this helps with #981. Lets continue there since I don't understand what GET parameters are... :)

 Comment 2: Having a PHP background, parameters can come from 2 source: the URL, the request body (often present only in case of `POST`/`PUT` method).

_Do not hesitate to skip the following paragraph, I'm in verbose mode this night..._
The URL is basically `http://host:port/path/to/resource?firstSoCalledGetParam=value&etc`.
`firstSoCalledGetParam` and `etc` are what PHP calls [GET](http://fr2.php.net/manual/en/reserved.variables.get.php) and [POST](http://fr2.php.net/manual/en/reserved.variables.post.php) parameters.
If the request body has a `Content-Type: application/x-www-form-urlencoded`, then the some other values can be given (under the same format `var=val&var2=val2`, with urlencoding). This is what curl does when using the `-d` flag (although it does not change the form of the value to match the `var=val&var2=val2` format).
The latter parameters are called POST parameters in PHP.
When coding a PHP webpage, one will make sure of the origin of the parameter, preventing easy parameter injection by modifying the URL, so that only user friendly parameters are exposed as GET parameters through the URL, and making sure the other one do come from the request body as POST parameters.

**To conclude:** GET and POST parameters somehow separate the presentation from the data.
This is why I proposed reading only POST parameters for a `POST` to the Update Settings API, leaving GET parameters only configure the presentation of the answer.

{'source': 'GithubIssues', 'repo_name_with_owner': 'elastic/elasticsearch', 'issue_id': 980666, 'repo_stars': 61696.0}