[x] Set credentialsRequired: false as a default on validateJWT and validateUser
[x] Make it so that validateUser won't fail with no req.user, will instead let them through (unless credentialsRequired:true, in which case boom.unauthorized)
[x] Change when those functions are called as appropriate
credentialsRequired: falseas a default onvalidateJWTandvalidateUservalidateUserwon't fail with no req.user, will instead let them through (unlesscredentialsRequired:true, in which caseboom.unauthorized)