[x] Set credentialsRequired: false as a default on validateJWT and validateUser
[x] Make it so that validateUser won't fail with no req.user, will instead let them through (unless credentialsRequired:true, in which case boom.unauthorized)
[x] Change when those functions are called as appropriate
credentialsRequired: false
as a default onvalidateJWT
andvalidateUser
validateUser
won't fail with no req.user, will instead let them through (unlesscredentialsRequired:true
, in which caseboom.unauthorized
)