Modify user routes to use ids for update/delete calls, update unit tests and ensure update/delete only happens on the auth token's associated user account
Use mongo ObjectIds to store refs instead of strings to save a few bytes per entry
Only allow updating or deleting authorizations you own, and return a 404 if the authorization with that particular user cannot be found.