add test that /allcandidates returns a collection
modify PostMatches to immediately 403 the request is the target id in the request isn't found in the database
modify the postMatches route to 403 when the request has an invalid target_id
Refactoring the matching logic

 Please enter the commit message for your changes. Lines starting
Refactor matching functionality