throw an error if no visit id is provided to the api/sep endpoint

[MikeyManoguerra]

lets discuss this before anyone takes it; but there is no situation that the app will need to query all the sep data from the browser. any requests like that should be done on the database directly for reporting services. we should block GET all requests and throw an error, i think