set X-USER-ID as email on Applicant creation; prevent Applicant details being returned when authenticated user is not the Applicant
invalid applicant ID returns 403 forbidden
disallow creating a second Applicant for given user_id
find applicant from user_id when creating LPA
prevent getting LPA when authenticated user is not the LPA applicant
use rack_moj_auth master branch; log secure token in development
Merge pull request #22 from ministryofjustice/cannot_access_another_persons_lpa

Cannot access another person's LPA