Protect users from other users

This protects users from accessing other user information.

The user routes are the only routes that still use an id to identify the
user.

This is now simply compared against the passport authenticated user