adds auth middleware on all calls to /api/schema

pretty sure we're using 'error' everywhere else in the server code