Actually, I just looked into this briefly and it seems like we can actually easily infer whether `_user` is required for this endpoint based on whether  `_user` is marked as required in the `validation` field of the endpoint. Alternatively, we could create an entirely new field in the endpoint options that would abstract most of this validation for us; it could work something like this:

```js
server.get({
     url: '...',
    authentication: {
        required: false,
        permissions: ['admin'] // required user permissions
    }
}, userlib.userIDView(...) { ... });
```

This could handle verification of the `_user` token (and rejecting the request if it is required by was not provided), verifying user permissions, and then avoid errors in the userID / userData views if `_user` is optional (which would also mean we bypass the DB request). It could also be expanded in the future to handle additional user validation as the need arises.

Thoughts? @cvan