Limit who can view each individual character.

Ensure that only specific users can view each character by adding an
authorization check to the character/<id>/ path. Add a unit test to ensure this
logic is working.