Only allow squads to be saved or deleted by owner.

* Set origins from environment if there.
That didn't seem to work.
Or maybe I needed to specify the methods.
Try removing that or
Allow all headers?
Change order of middleware.
I've lost track of what order I'm doing things, now.
Keep moving middlwares around.
Add some debugging output.
Testing if logging is working at all.
Maybe PUT is weird.
Maybe the 403 was because of this CSRF protection bug.
Maybe I need to move configuration earlier.
Explicitly set cookie secret; use `Rack::MethodOverride`.
Typo: check `rows` for emptiness when saving new squad.

`enable :method_override` was working, so use that.
Pass `nil` for `id` when creating new squad.
Fixed how UUID is generated.
Actually pass the user id when creating a squad.