Sanitized information returned to users...

Per https://github.com/twilson63/express-couchUser/issues/11 I raised concerns about users being passed their own (and other people's) hashes, encrypted passwords, etc.   Based on our conversation I have wrapped all outgoing user data objects in calls to "only" which only allows a range of whitelisted fields.  I also made it a requirement that a user at least be logged in to access user lookup and management functions.

This took longer than expected as there were a lot of calls that expected to get raw couch records and pass that on.  I ended up making "our" delete and update methods get the couch record separately and then perform the main action based on the user-supplied data.

For this round I did go through the mocha tests and review.  I ended up adding tests for the new /api/user/current functions and getting the signin/signout tests to work again (previously they were commented out).