Prevent settings edits on other users' accounts

It turns out this was actually okay because all of the edits require
password entry currently. But that was really nonobvious.

I made a pass through the other controllers checking auth stuff; there
are a lot of places where we 500 on not-logged-in users, but that's when
as a result of checking IDs. I think the other routes are okay.
Merge pull request #238 from eve-val/settings-account-check

Prevent settings edits on other users' accounts