adds auth middleware on all calls to /api/schema

pretty sure where using 'error' everywhere else in the server code