Thanks Jeff, that was what I needed… being able to spy on the XHR requests directly is clever!
For others who might need the info: I was able to PUT to /u/username.json and update the custom fields that way. And it appears you can only make the call with a username, not with a user ID (too bad).