Users#update: update the current user

We don't need to do a query to find the user record since we already
have it.
Add authentication to all our controllers

Some of these actions will eventually be ooened up to the public, but
right now we require a user account to hit pretty much all of them.
Fix failing tests due to new auth requirements

Make some of the let's one-liners