Add failing test
User routes are protected
The 401 should really be a 403

The user making the request is a real authorized user, but is forbidden
from accessing the specified resource.
Protect users from other users

This protects users from accessing other user information.

The user routes are the only routes that still use an id to identify the
user.

This is now simply compared against the passport authenticated user
Merge branch 'feature/protect-user' into dev