Added requireTeacher and set that up for all routes that should have
that protection.

Moved the static middleware above the routes stuff. Otherwise it was
going through all the auth stuff even though it shouldn't.