Cannot access another person's LPA

* Uses 'X-USER-ID' header to find authenticated user's email
* On applicant creation, sets applicant's email to be authenticated user's email
* Uses authenticated user's email for authorisation
* GET applicant when authenticated user is not the applicant returns  403 Forbidden
* GET lpa when authenticated user is not the applicant returns  403 Forbidden
* Applicant response JSON no longer contains email