More cleanup, wrap all routes in auth, and send proper 401s

The database migration stuff is still a major pain