Use the actual authenticated user in REST endpoints

[brianhelba]

Also, require an authenticated user to call the terms/agreement endpoints and refactor the test names for agreement tests.

Fixes #111