Authentication optinal / required

[db0company]

The API document has been updated. See sections Legend and the last paragraph of the Itineraries section introduction.

• [x] For each request that accept an optional token, make sure the token can be provided and is used to alter the behavior of the request
• [x] For each request that require a token, make sure it is used properly and throw an error otherwise.
• [x] For each request that require a token and that the object used is owned by the authenticated user, make sure it is used properly and that the authenticated user owns the object, and throw an error otherwise.

[db0company]

List of behavior change depending on token when optional:

• [x] POST /itineraries/ with or without a token changes the owner field in the database (see #18)
• [x] POST /itineraries/ with a valid token accepts a name and favorite, otherwise ignored
• [x] work only if the itinerary owner is null (anyone can do it) OR if the token is owned by the owner of the itinerary:
  • [x] PUT /itineraries/{id}/
  • [x] POST /itineraries/{id}/destinations
  • [x] PUT /itineraries/{id}/destinations/{position}
  • [x] DELETE /itineraries/{id}/destinations/{position}
  • [x] DELETE /itineraries/{id}