#53/climbing api user seperation is not enforced for spots

[FlorianPix]

• [x] add user_id to SpotModel
• [x] sort attributes alphabetically in SpotModel and CreateSpotModel (backend)
• [x] remove not used attributes
• [x] in show_spots(...) only return spots with the correct user_id
• [x] in show_spot(...) only allow access to spots with the correct user_id

closes #53

[FlorianPix]

update_spot still needs to be checked for the same bug but this will be done together with #38