Update Protected Routes to use 'auth' before filter, ensure privacy

* the auth filter removes redundant code
* In some instances (like the playlist controller), we need to ensure
  user's can't edit other people's data.