Secure sensitive endpoints

[Ivan-Johnson]

At present, there is no attempt at authentication whatsoever. Only authenticated users should be able to access endpoints that return personal information.