Authorization

I put in most authorization for the routes that needed them.  Some routes I was unclear about, authorization-wise, were:

team/roster
mail/
email templates
attendance
family/delete

For most of those, I'm not sure if they are even used, or who should be able to access them.