Added correct status code for nonexistent user token
Added test for Place: user should not be able update Place without correct permissions