Outcomes API controllers use the return unless pattern consistently

In most controller methods we use the return unless pattern.  Some of
them were not like that, which was unfortunate.  They are now however.

Refs CNVS-16955

Test Plan:

    Using the API:
        - create a new outcome group and an outcome
        - query for the group and outcome and make sure they return properly
        - make an update and re-query, verifying correct info returned
        - Delete the group and outcome
        - Make sure each of those actions fail if you're unauthorized

    Using the UI:
        - create a new outcome group and an outcome
        - Refresh the page and make sure they are listed properly
        - make an update and refresh the page again, verifying correct info returned
        - Delete the group and outcome
        - Make sure each of those actions fail if you're unauthorized

Change-Id: Ie8781149b27eff5a19327e3617c6ae140462bd14
Reviewed-on: https://gerrit.instructure.com/45159
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Matt Berns <mberns@instructure.com>
QA-Review: Sean Lewis <slewis@instructure.com>
Product-Review: Benjamin Porter <bporter@instructure.com>