Added user authentication and refactored routes.

Also removed a badly written controller spec, since it was causing problems. Will rewrite it when with the other specs.
You can still have and use `find_item` if you need to.