Protect the necessary routes

[paxblueribbon]

Don't protect the create-admin route until a default admin is being created on db start

• Protect most if not all routes with JWTs
• Make sure if not admin role, user can only engage with their own content

[paxblueribbon]

Check out the protected route from the user routes for the example of how to do this through middleware:

router.get('/protected', passport.authenticate('jwt', { session: false }), function(req, res) { res.status(200).json({ msg: 'Congrats! You are seeing this because you are authorized.'}); });