Fix middleware order, clean up app.js and routes

- Also looked at the models (as requested)
- Started on authentication