fixing candidate route tests, most of them now properly sign in and are authorized
all candidate routes properly check permissions and return proper values
Merge branch 'devDan' into dev